High severity7.5NVD Advisory· Published Jan 27, 2026· Updated Jun 17, 2026

CVE-2026-1315

Description

By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authentication or firmware integrity. An unauthenticated attacker can trigger a persistent denial of service, requiring a manual reboot or application initiated restart to restore normal device operation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

TP-Link/Tapo C220 Firmware
cpe:2.3:o:tp-link:tapo_c220_firmware:*:*:*:*:*:*:*:*
Range: <1.4.2
TP-Link/Tapo C520ws Firmware
cpe:2.3:o:tp-link:tapo_c520ws_firmware:*:*:*:*:*:*:*:*
Range: <1.2.3
Tapo/C220llm-create
Range: v1
Tapo/C520WSllm-fuzzy
Range: v2
TP-Link/Tapo C220llm-fuzzy
Range: v1
TP-Link/Tapo C520ws V2v5
Range: 0

Patches

Vulnerability mechanics

References

www.tp-link.com/us/support/faq/4923/nvdVendor Advisory
www.tp-link.com/en/support/download/tapo-c220/v1/nvdProduct
www.tp-link.com/en/support/download/tapo-c520ws/v2/nvdProduct
www.tp-link.com/us/support/download/tapo-c220/v1.60/nvdProduct
www.tp-link.com/us/support/download/tapo-c520ws/v2/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000