Security Advisory: Denial-of-Service Vulnerability in RTSP Input Handling on Tapo C520WS (CVE-2026-8714)
Vulnerability and Impact Description:
CVE-2026-8714
A denial-of-service vulnerability exists in the RTSP server component of Tapo C520WS v2 due to improper handling of syntactically invalid input. Crafted inputs can trigger a processing error, causing the RTSP service to enter non-responsive state.
Successful exploitation may cause the RTSP in a denial-of-service condition.
CVSS v4.0 Score: 7.1 / High
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products/Versions and Fixes:
|
Affected Product Model |
Hardware Version |
Fixed Version |
|
Tapo C520WS |
V2 |
1.2.6 Build 260528 Rel.60422n |
Recommendations:
We strongly recommend that users with affected devices take the following actions:
- Follow the instructions to update to the latest firmware version to fix the vulnerabilities:
US: Download for Tapo C520WS | TP-Link
EN: Download for Tapo C520WS | TP-Link
Disclaimer:
This advisory is provided for informational purposes only and is subject to change without notice. The information is provided “as is” without warranties of any kind. TP-Link recommends that customers apply available firmware updates or implement documented workarounds as provided in this advisory. Devices/systems that are not updated or mitigated as described may remain vulnerable.
Looking For More
Is this faq useful?
Your feedback helps improve this site.
TP-Link Community
Still need help? Search for answers, ask questions, and get help from TP-Link experts and other users around the world.