TP-Link Tapo C520WS Denial-of-Service Vulnerability via HTTP Request Path Parsing

A denial-of-service vulnerability exists in the TP-Link Tapo C520WS camera, version 2.6, due to improper handling of HTTP request paths. The vulnerability arises because the device enforces length limits on raw request paths but fails to consider path expansion during normalization. An attacker on the same network can exploit this by sending a crafted HTTP request that causes a buffer overflow and memory corruption, leading to a system crash or device reboot.

Impact

Exploitation of this vulnerability causes a buffer overflow and memory corruption, disrupting system operations or causing the device to reboot.

Remediation

Users are advised to update to the latest firmware version. The updated firmware can be downloaded from the TP-Link website, either from the US or the international page.