Critical TP-Link Omada Flaws Let Attackers Crash Routers, Trigger DoS

Key Takeaways

• Multiple critical vulnerabilities have been discovered in TP-Link’s Tapo C520WS smart security cameras.
• The flaws, including an authentication bypass and several buffer overflows, could allow adjacent network attackers to take control or disrupt camera operations.
• Successful exploitation can lead to Denial-of-Service (DoS) conditions, device crashes, or unauthorized configuration changes.
• Affected devices are Tapo C520WS v2.6 running firmware prior to version 1.2.4 Build 260326 Rel. 24666n.
• TP-Link has released urgent firmware updates, and users are strongly advised to apply them immediately.

TP-Link Tapo C520WS Cameras Exposed to Critical Flaws

A series of high-severity security vulnerabilities have been identified in TP-Link’s Tapo C520WS smart security cameras. These critical flaws could enable attackers on the same local network to initiate Denial-of-Service (DoS) attacks, cause devices to crash, or completely circumvent authentication protocols. The immediate impact of such an attack, particularly a DoS, is the creation of a significant security blind spot, rendering surveillance systems ineffective.

TP-Link has responded by releasing essential firmware updates to mitigate these risks. For users who rely on the Tapo C520WS for active monitoring and property security, applying these patches is paramount to maintaining an effective defense posture.

Deep Dive into the Vulnerabilities

The most severe vulnerability, tracked as CVE-2026-34121, carries a CVSS v4.0 score of 8.7. This flaw is an authentication bypass located within the HTTP handling of the camera’s DS configuration service. Researchers found that due to inconsistencies in parsing and authorization logic for JSON requests, an unauthenticated attacker within the same network segment can bypass security checks. By appending an exempt action to a privileged request, malicious actors can execute restricted configuration changes and alter the device’s state without requiring valid login credentials.

In addition to the authentication bypass, several buffer overflow vulnerabilities were uncovered, which attackers could exploit to crash devices or force unexpected reboots, resulting in a full Denial-of-Service.

• CVE-2026-34118, CVE-2026-34119, CVE-2026-34120: These heap-based overflow vulnerabilities, each with a CVSS score of 7.1, arise from insufficient boundary validation in HTTP and streaming inputs. Attackers can transmit specially crafted payloads to induce memory corruption during HTTP POST parsing, segmented request appending, or asynchronous video stream processing.
• CVE-2026-34122: This stack-based overflow, also rated CVSS 7.1, was found in the DS configuration service. It allows attackers to provide excessively long configuration parameters, leading to the service crashing.
• CVE-2026-34124: With a CVSS score of 7.1, this path-expansion overflow resides in the HTTP request parsing logic. The system checks raw request lengths but fails to account for size increases during path normalization, enabling adjacent attackers to trigger a system interruption.

These vulnerabilities specifically impact the Tapo C520WS v2.6 models running firmware versions older than 1.2.4 Build 260326 Rel. 24666n. Users are strongly advised to update their devices immediately to avoid exposure to unauthorized configuration changes and persistent device instability.

What You Should Do

• Immediately update your TP-Link Tapo C520WS v2.6 camera firmware to version 1.2.4 Build 260326 Rel. 24666n or newer.
• You can download the updated firmware directly from TP-Link’s official support pages.
• Alternatively, check for available updates through the companion mobile application for your Tapo devices.
• Ensure your security cameras are isolated on a separate network segment if possible, to limit adjacent network access.
• Regularly check for and apply firmware updates for all smart devices to address emerging security vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.