CVE-2026-6241
Medium
Description
An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in DoS condition that impacts normal device operation.
SeverityMedium
CVSS6.8
Exploit probability—
ProductTapo C520WS v2
PublishedJun 6, 2026
First seenJun 6, 2026
Weakness typeCWE-134CWE-134
How to fix
Update
- TP-Link Systems Inc. Tapo C520WS v21.2.6 Build 260528 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TP-Link Systems Inc. Tapo C520WS v2 | v < 1.2.6 Build 260528 | 1.2.6 Build 260528 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.