TP-Link Tapo C520WS Heap-Based Buffer Overflow Vulnerability Leading to Denial-of-Service

A heap-based buffer overflow vulnerability has been identified in the TP-Link Tapo C520WS camera, version 2.6. The vulnerability arises in the HTTP POST body parsing logic, where there is a lack of validation for the remaining buffer capacity after dynamic allocation. This insufficient boundary validation allows an attacker on the same network segment to send crafted payloads that overwrite memory beyond allocated buffer limits, leading to heap memory corruption. Successful exploitation causes a denial-of-service condition, causing the device's process to crash or become unresponsive.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, where the device's process crashes or becomes unresponsive.

Remediation

Users are advised to update to the latest firmware version. The updated firmware can be downloaded from the TP-Link website.