CVE-2026-34123

On Tapo C520WS v2, restricted accounts (for example, hub users) are intended to execute only a limited set of low‑sensitivity operations. Due to a logic flaw in the device’s API authorization mechanism, an attacker can craft requests that leverage legitimate “method mapping” behavior to bypass whitelist restrictions, allowing restricted operations to be masked as permitted requests and executed. Successful exploitation may allow an attacker (with access to a restricted account) to execute unauthorized sensitive operations. Depending on the operation invoked, impact could include device resets, unintended configuration changes, or disruption of normal operation, leading to loss of availability and integrity of the device.

CVSS

No CVSS.

References

Link	Resource
https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes
https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes
https://www.tp-link.com/us/support/faq/5120/

Configurations

No configuration.

History

23 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) En Tapo C520WS v2, las cuentas restringidas (por ejemplo, usuarios del hub) están destinadas a ejecutar solo un conjunto limitado de operaciones de baja sensibilidad. Debido a un fallo lógico en el mecanismo de autorización de la API del dispositivo, un atacante puede elaborar solicitudes que aprovechan el comportamiento legítimo de 'mapeo de métodos' para eludir las restricciones de la lista blanca, permitiendo que las operaciones restringidas se enmascaren como solicitudes permitidas y se ejecuten. La explotación exitosa puede permitir a un atacante (con acceso a una cuenta restringida) ejecutar operaciones sensibles no autorizadas. Dependiendo de la operación invocada, el impacto podría incluir restablecimientos del dispositivo, cambios de configuración no deseados o interrupción del funcionamiento normal, lo que lleva a la pérdida de disponibilidad e integridad del dispositivo.

06 Jun 2026, 00:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-06 00:16

Updated : 2026-07-23 07:10

NVD link : CVE-2026-34123

Mitre link : CVE-2026-34123

CVE.ORG link : CVE-2026-34123

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-34123", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34123", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T13:06:49.208336Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C520WS v2", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.6 Build 260528", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-06T00:16:40.833", "references": [{"url": "https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5120/", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "On Tapo\nC520WS v2, restricted accounts (for example, hub users) are intended to execute\nonly a limited set of low\u2011sensitivity operations. Due to a logic flaw in the\ndevice\u2019s API authorization mechanism, an attacker can craft requests that\nleverage legitimate \u201cmethod mapping\u201d behavior to bypass whitelist restrictions,\nallowing restricted operations to be masked as permitted requests and executed.\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker (with access to a restricted account) to\nexecute unauthorized sensitive operations.\u00a0\nDepending on the operation invoked, impact could include device\nresets, unintended configuration changes, or disruption of normal operation,\nleading to loss of availability and integrity of the device."}, {"lang": "es", "value": "En Tapo C520WS v2, las cuentas restringidas (por ejemplo, usuarios del hub) est\u00e1n destinadas a ejecutar solo un conjunto limitado de operaciones de baja sensibilidad. Debido a un fallo l\u00f3gico en el mecanismo de autorizaci\u00f3n de la API del dispositivo, un atacante puede elaborar solicitudes que aprovechan el comportamiento leg\u00edtimo de 'mapeo de m\u00e9todos' para eludir las restricciones de la lista blanca, permitiendo que las operaciones restringidas se enmascaren como solicitudes permitidas y se ejecuten.\n\nLa explotaci\u00f3n exitosa puede permitir a un atacante (con acceso a una cuenta restringida) ejecutar operaciones sensibles no autorizadas. Dependiendo de la operaci\u00f3n invocada, el impacto podr\u00eda incluir restablecimientos del dispositivo, cambios de configuraci\u00f3n no deseados o interrupci\u00f3n del funcionamiento normal, lo que lleva a la p\u00e9rdida de disponibilidad e integridad del dispositivo."}], "lastModified": "2026-07-23T07:10:00.113", "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}