CVE-2026-34121
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
An authentication bypass vulnerability in the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 and C210 v3 stems from inconsistent parsing and authorization logic in JSON requests. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS actions, bypassing authorization checks.
Risk Assessment
Successful exploitation allows unauthenticated execution of restricted configuration actions, potentially resulting in unauthorized modification of device state.
Recommendation
Update TP-Link Tapo camera firmware to a patched version and restrict network access to the configuration interface.
Other vulnerabilities in TP-Link Tapo
See all- CVE-2026-0651High
A path traversal vulnerability was identified in TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails, allowing bypass of directory restrictions.
- CVE-2023-27098High
The TP-Link Tapo APK up to version 2.12.703 uses hardcoded credentials for access to the login panel. This means anyone who knows these credentials can gain unauthorized access to the application.
Original NVD description (English source)
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 and C210 v3 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks. Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS