TP-Link Tapo C520WS Heap-Based Buffer Overflow Vulnerability Leading to Denial-of-Service

A heap-based buffer overflow vulnerability has been identified in the TP-Link Tapo C520WS camera, specifically in version 2.6. The vulnerability arises in the HTTP parsing loop, where segmented request bodies are appended without proper verification of write boundaries. This lack of continuous boundary validation allows an attacker on the same network segment to send crafted payloads that corrupt heap memory by writing beyond the limits of allocated buffers. Successful exploitation of this vulnerability causes a Denial-of-Service condition, crashing or freezing the device's process.

Impact

Exploitation of this vulnerability leads to heap memory corruption, causing a Denial-of-Service condition where the device's process crashes or becomes unresponsive.

Remediation

Users are advised to update to the latest firmware version. The updated firmware can be downloaded from the TP-Link website.