Buffer overflow in TP-Link Systems Inc. Tapo C520ws V2

CVE-2026-6240

A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a crafted malicious request containing an excessive number of identifiers to overflow stack memory. Successful exploitation may result in a service crash or deadlock, leading to DoS affecting device management and monitoring functionality.

Vulnerability class: Buffer Overflow

EPSS: 0.002 (7.7th percentile) — read the EPSS interpretation.