CVE-2026-8714
MEDIUM WAF: Medium
CVSS 6.5
Published: 2026-06-05
CWE-20
A denial-of-service vulnerability exists in the RTSP server component of TP-Link Tapo C520WS v2 due to improper handling of syntactically invalid input. Crafted inputs can trigger a processing error, causing the RTSP service to enter non-responsive state. Successful exploitation may cause the RTSP in a denial-of-service condition.
WAF Coverage Analysis
Improper Input Validation
Medium WAF Coverage
OWASP: A03:2021 Injection
920xxx - Protocol Enforcement 941xxx - XSS / XXE 942xxx - SQL Injection
Affected Software
| Vendor | Product | Version |
|---|---|---|
| tp-link | tapo_c520ws_firmware | up to 1.2.6 |
References
- www.tp-link.com (Product)
- www.tp-link.com (Product)
- www.tp-link.com (Vendor Advisory)