CVE-2026-6241— Authenticated Format String Vulnerability in ONVIF AddScopes Method on TP-Link Tapo C520WS
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TP-Link Systems Inc. | Tapo C520WS v2 | < 1.2.6 Build 260528 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-6241
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authenticated Format String Vulnerability in ONVIF AddScopes Method on TP-Link Tapo C520WS
Source: CVE Program / CVE List V5
Vulnerability Description
An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in DoS condition that impacts normal device operation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部控制的格式字符串
Source: CVE Program / CVE List V5
Vulnerability Title
TP-Link Tapo C520WS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TP-Link Tapo C520WS是中国普联（TP-Link）公司的一个WiFi摄像头。 TP-Link Tapo C520WS v2版本存在安全漏洞，该漏洞源于ONVIF AddScopes中格式字符串漏洞，用户控制的输入未充分清理即传递给格式化函数，可能导致经过身份验证的攻击者注入格式说明符，造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TP-Link Systems Inc. | Tapo C520WS v2 | 0 ~ 1.2.6 Build 260528 | - |
II. Public POCs for CVE-2026-6241
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6241
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-6241 (1)
Same Patch Batch · TP-Link Systems Inc. · 2026-06-05 · 6 CVEs total
| CVE-2026-6240 | Authenticated Stack-based Buffer Overflow in ONVIF DeleteUsers Service on TP-Link Tapo C52 | |
| CVE-2026-6239 | Authenticated Stack-based Buffer Overflow in ONVIF CreateUsers Service in TP-Link Tao C520 | |
| CVE-2026-6242 | Authenticated Format String Vulnerability in ONVIF Subscribe Service on TP-Link Tapo C520W | |
| CVE-2026-34123 | Whitelist Validation Bypass in TP-Link Tapo C520WS | |
| CVE-2026-8714 | Denial-of-Service Vulnerability in RTSP Input Handling on TP-Link's Tapo C520WS |
IV. Related Vulnerabilities
Same product: Tapo C520WS v2
- CVE-2026-6242
Authenticated Format String Vulnerability in ONVIF Subscribe - CVE-2026-6240
Authenticated Stack-based Buffer Overflow in ONVIF DeleteUse - CVE-2026-6239
Authenticated Stack-based Buffer Overflow in ONVIF CreateUse - CVE-2026-34123
Whitelist Validation Bypass in TP-Link Tapo C520WS - CVE-2026-8714
Denial-of-Service Vulnerability in RTSP Input Handling on TP
Same vendor: TP-Link Systems Inc.
- CVE-2026-15141
Referer Validation Bypass in TL-WR820N Web Management Interf - CVE-2025-30241
OS Command Injection in Web Interface in Multiple TP-Link Ag - CVE-2025-30240
Arbitrary File Read via Improper Symlink Handling in USB HTT - CVE-2025-30239
Sensitive Data Exposure due to Hardcoded Cryptographic Keys - CVE-2025-30238
Privilege Escalation via Improper Authorization in User Mana
Same weakness: CWE-134
- CVE-2026-12004
Security vulnerabilities have been found in IBM Verify Ident - CVE-2026-67244
A format string vulnerability was found in the Notification - CVE-2026-18188
A format string vulnerability was found in the Rsync Backup - CVE-2026-18187
A format string vulnerability was found in the Internal Back - CVE-2026-18186
A stored format string vulnerability was found in the FTP Ba
V. Comments for CVE-2026-6241
No comments yet