An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks.
Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.
References
| Link | Resource |
|---|---|
| https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes | Release Notes |
| https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes | Release Notes |
| https://www.tp-link.com/us/support/faq/5047/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
06 Apr 2026, 20:24
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | () https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes - Release Notes | |
| References | () https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes - Release Notes | |
| References | () https://www.tp-link.com/us/support/faq/5047/ - Vendor Advisory | |
| First Time |
Tp-link tapo C520ws Firmware
Tp-link Tp-link tapo C520ws |
|
| CPE | cpe:2.3:o:tp-link:tapo_c520ws_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:tp-link:tapo_c520ws:2.6:*:*:*:*:*:*:* |
02 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-02 18:16
Updated : 2026-04-06 20:24
NVD link : CVE-2026-34121
Mitre link : CVE-2026-34121
CVE.ORG link : CVE-2026-34121
JSON object : View
Products Affected
tp-link
- tapo_c520ws_firmware
- tapo_c520ws
CWE
CWE-287
Improper Authentication