CVE-2026-34124

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada tp-link tapo c520ws firmware. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent network may send a crafted HTTP request to cause buffer overflow and memory corruption, leading to system interruption or device reboot.

Rincian

Terbit di NVD

2 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tp-link.com/us/support/faq/5047/ advisory vendor
• https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes release notes
• https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes release notes