Vulnerability details
CVE-2026-34121
TP-Link Systems Tapo C210TP-Link Systems Tapo C520WS
Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS and C210
CVSS 4.0
8.7High
Official description
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 and C210 v3 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks. Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (TPLink) | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| TP-Link Systems Inc. | Tapo C210 v3.6 | v < 1.2.7 Build 260818 Rel.64715n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | Tapo C520WS v2.6 | v < 1.2.4 Build 260326 Rel.24666n | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes patch
- https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes patch
- https://www.tp-link.com/us/support/faq/5047/ vendor-advisory
- https://www.tp-link.com/us/support/download/tapo-c210/v3.60/#Firmware-Release-Notes patch
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-02
- Last updated
- 2026-11-03
- State
- Published
- Assigner (CNA)
- TPLink
Exploit prediction (EPSS)
0.46%
Probability of exploitation in 30 days
40.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-287Improper Authentication