PT-2026-29849 · Tp Link Systems+1 · Tapo C520Ws V2.6+1

Published 2026-04-02 · Updated 2026-04-29 · CVE-2026-34121

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link Tapo C520WS version 2.6

Description An authentication bypass exists in the HTTP handling of the DS configuration service. The issue stems from inconsistent parsing and authorization logic in JSON requests during authentication checks. An unauthenticated attacker can bypass authorization by appending an authentication-exempt action to a request that contains privileged DS do actions. This allows the unauthorized execution of restricted configuration actions, which may lead to the unauthorized modification of the device state.

Recommendations Update TP-Link Tapo C520WS version 2.6 to the latest firmware version provided by the manufacturer. Isolate management interfaces from untrusted networks.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-34121

Affected Products

Tapo C520Ws V2.6

Tapo C520Ws Firmware

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-34121 · Security Note
• https://tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes · Patch
• https://tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes · Patch
• https://tp-link.com/us/support/faq/5047 · Vendor Advisory
• https://reddit.com/r/SecOpsDaily/comments/1sz6rfe/cve202634121_tplink_http_authentication_bypass · Reddit Post
• https://twitter.com/syedaquib77/status/2040038290472989143 · Twitter Post
• https://twitter.com/syedaquib77/status/2040008191413485803 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1sz6tbb/secopsdaily_20260429_roundup · Reddit Post
• https://twitter.com/syedaquib77/status/2040015449086136453 · Twitter Post