CVE-2026-6242

Medium

Description

An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification service to terminate unexpectedly, resulting in the loss of real-time alarm functionality and disruption of event notifications.

SeverityMedium

CVSS6.8

Exploit probability—

ProductTapo C520WS v2

PublishedJun 6, 2026

First seenJun 6, 2026

Weakness typeCWE-134CWE-134

How to fix

Update

TP-Link Systems Inc. Tapo C520WS v21.2.6 Build 260528 or later

Patches

Vendor advisories

tp-link.com/us/support/faq/5120/

Affected products

Product	Affected versions	Fixed in
TP-Link Systems Inc. Tapo C520WS v2	v < 1.2.6 Build 260528	1.2.6 Build 260528

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.