CVE-2026-6241

Vulnerability

An authenticated format string vulnerability exists in the ONVIF AddScopes method of the Tapo C520WS v2. User-controlled input is improperly passed to formatting functions without adequate sanitization, allowing an attacker to inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior [3].

Exploitation

An authenticated attacker can exploit this vulnerability by injecting format specifiers into ONVIF scope parameters. This manipulation targets the memory handling behavior of the ONVIF management service, requiring network access and valid user credentials to the device [3].

Impact

Successful exploitation of this format string vulnerability can cause the ONVIF management service to crash, leading to a Denial-of-Service (DoS) condition. This DoS impacts normal device operation and management functions [3].

Mitigation

TP-Link has released firmware updates to address this vulnerability. Users are advised to update their Tapo C520WS v2 devices to the latest firmware version. Specific fixed version details are available in the vendor's security advisory [3]. References [1] and [2] provide access to firmware download pages for the Tapo C520WS.