CVE-2026-34119

Katalog CVE

CVSS 6.5 · Medium EPSS 0,36%

Kerentanan Heap-based Buffer Overflow pada tp-link tapo c520ws firmware. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when appending segmented request bodies without continuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input.  An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries.  Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.

Rincian

Terbit di NVD

2 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tp-link.com/us/support/faq/5047/ advisory vendor
• https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes release notes
• https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes release notes