Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C100, C101, C210 & C520WS
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5, C210 v3.6 and C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input. An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries. Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.
CVE-2026-34118
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-34118
Tapo C520WS v2.6
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Tapo C100 v5
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Tapo C101 v5
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Tapo C210 v3
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "TP-Link Systems Inc.",
"modules": [
"HTTP POST"
],
"product": "Tapo C520WS v2.6",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.2.4 Build 260326 Rel.24666n",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "TP Link Systems Inc.",
"product": "Tapo C100 v5",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.5.4 Build 260528 Rel.11462n",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "TP Link Systems Inc.",
"product": "Tapo C101 v5",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.5.4 Build 260528 Rel.11462n",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "TP Link Systems Inc.",
"product": "Tapo C210 v3",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.6_1.2.7 Build 260818",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-34118
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #41889 · Revision 1
- Added to Heist Feed
- Publisher date