TP-Link Systems Inc Tapo c520ws v2 vulnerabilities

5 CVEs affecting TP-Link Systems Inc Tapo c520ws v2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-6242, published 2026-06-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-6240, published 2026-06-06. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks when handling multiple user deletion parameters. An…
CVE-2026-6239, published 2026-06-06. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. A stack‑based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request…
CVE-2026-6242, published 2026-06-06. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An…
CVE-2026-6241, published 2026-06-06. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate…
CVE-2026-34123, published 2026-06-06. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. On Tapo C520WS v2, restricted accounts (for example, hub users) are intended to execute only a limited set of low‑sensitivity operations. Due to a logic flaw in the device’s API authorization…