TP-Link Vulnerabilities - Attackers Can Crash Routers
Basically, hackers can make your TP-Link camera stop working if you don't update it.
TP-Link's Tapo C520WS cameras have critical vulnerabilities that can lead to device crashes. Users must update their firmware immediately to avoid security risks and unauthorized access. Don't leave your surveillance equipment exposed!
What Happened
Multiple high-severity vulnerabilities have been discovered in TP-Link’s Tapo C520WS smart security cameras. These flaws could allow attackers on the same network to trigger Denial-of-Service (DoS) conditions, which can crash the device or bypass authentication entirely. The vulnerabilities are serious enough that TP-Link has issued urgent firmware updates to fix them.
Who's Affected
The vulnerabilities specifically affect users of the Tapo C520WS camera running firmware versions before 1.2.4 Build 260326 Rel. 24666n. If you own this device and have not updated your firmware, you are at risk.
What Data Was Exposed
While the vulnerabilities primarily lead to device crashes, they also allow unauthorized configuration changes. This means that attackers could potentially manipulate the camera's settings without needing valid login credentials, creating a significant security risk for users relying on these cameras for surveillance.
The Flaw
The most critical vulnerability is CVE-2026-34121, which has a CVSS score of 8.7. It involves an authentication bypass in the camera’s DS configuration service. Attackers can exploit this flaw by sending specially crafted requests that bypass security checks.
In addition to this, several buffer overflow vulnerabilities have been identified:
- CVE-2026-34118, CVE-2026-34119, CVE-2026-34120: These heap-based overflow flaws (CVSS 7.1) can lead to memory corruption and device crashes.
- CVE-2026-34122: A stack-based overflow that allows attackers to crash the service by supplying excessively long parameters.
- CVE-2026-34124: A path-expansion overflow that can interrupt the system due to improper request length checks.
Patch Status
TP-Link has released firmware updates to address these vulnerabilities. Users are strongly urged to apply the latest patches immediately. Ignoring these updates can leave devices vulnerable to unauthorized access and persistent crashes.
Immediate Actions
To protect your device:
- Update your firmware: Visit TP-Link’s official support pages or use the companion mobile app to check for updates.
- Monitor your device: Keep an eye on the camera's performance and any unusual behavior.
- Stay informed: Follow cybersecurity news for updates on vulnerabilities and security practices.
By taking these steps, you can help ensure that your TP-Link Tapo C520WS remains secure and functional.