PT-2026-30216 · Tp Link Systems · Tapo C520Ws V2

CVE-2026-34123 · Published 2026-04-03 · Updated 2026-06-06

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tapo C520WS v2

Description A logic flaw in the API authorization mechanism allows users with restricted accounts, such as hub users, to bypass whitelist restrictions. By leveraging legitimate method mapping behavior, an attacker can craft requests that mask restricted operations as permitted ones. This can lead to the execution of unauthorized sensitive operations, potentially resulting in device resets, unintended configuration changes, or disruption of normal operation, affecting the device's availability and integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-34123

Affected Products

Tapo C520Ws V2

References · 7

• https://tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34123 · Security Note
• https://tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes · Patch
• https://tp-link.com/us/support/faq/5120 · Vendor Advisory
• https://t.me/CVEtracker/56029 · Telegram Post
• https://t.me/cveNotify/166311 · Telegram Post
• https://twitter.com/syedaquib77/status/2040038290472989143 · Twitter Post