CVE-2026-6242: Tapo C520WS Format String DoS Vulnerability

CVE-2026-6242 Overview

CVE-2026-6242 is an authenticated format string vulnerability [CWE-134] in the Open Network Video Interface Forum (ONVIF) Subscribe service of the TP-Link Tapo C520WS v2 camera. The service fails to properly handle externally supplied parameters within formatting functions. An authenticated attacker on an adjacent network can inject crafted format strings through event subscription requests or the notification generation path.

Successful exploitation causes the event notification service to terminate unexpectedly. This disrupts real-time alarm delivery and event notifications on the affected camera.

Critical Impact

Authenticated attackers on the local network can crash the ONVIF event notification service, eliminating real-time alarm functionality on the Tapo C520WS v2 camera.

Affected Products

• TP-Link Tapo C520WS v2 (wireless outdoor security camera)
• ONVIF Subscribe service component on affected firmware
• Deployments relying on ONVIF event notifications for alarm delivery

Discovery Timeline

• 2026-06-06 - CVE-2026-6242 published to the National Vulnerability Database (NVD)
• 2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-6242

Vulnerability Analysis

The vulnerability resides in the ONVIF Subscribe service, which handles event subscription and notification delivery for the Tapo C520WS v2. ONVIF is a standardized protocol used by IP cameras for interoperable event streaming, including motion alerts and tamper notifications.

The service passes attacker-controlled input directly into formatting functions such as printf-style routines without sanitizing format specifiers. When the input contains tokens like %s, %x, or %n, the formatting function interprets them as conversion directives. This causes the function to read memory from unintended locations or perform invalid operations.

The attack requires authenticated access and adjacent network positioning, which limits the threat to attackers already inside the local network segment. The impact is constrained to availability of the event notification subsystem with no confidentiality or integrity loss.

Root Cause

The root cause is improper neutralization of format string specifiers in the ONVIF Subscribe service. Externally supplied parameters from event subscription requests reach formatting functions without being treated as literal data. The service should pass user input as an argument to %s rather than as the format string itself.

Attack Vector

An attacker first authenticates to the ONVIF interface on the camera. The attacker then submits a crafted SOAP Subscribe request or triggers the notification generation path with format specifier tokens embedded in fields the service later formats. Processing the malformed input causes the event notification service process to terminate, halting alarm delivery until the service restarts.

No verified exploit code is publicly available. Refer to the TP-Link Firmware Release Notes for vendor technical details.

Detection Methods for CVE-2026-6242

Indicators of Compromise

• ONVIF event notification service repeatedly crashing or restarting on the Tapo C520WS v2
• Loss of motion or tamper alerts from cameras while the device otherwise remains reachable
• Authenticated ONVIF Subscribe requests containing format specifier tokens such as %s, %x, %n, or %p in subscription fields
• SOAP traffic to ONVIF endpoints from unexpected adjacent-network hosts

Detection Strategies

• Inspect ONVIF SOAP requests at the network layer for format specifier patterns in Subscribe, Renew, or notification consumer fields
• Correlate camera service restarts with preceding authenticated ONVIF traffic from the same source
• Baseline normal ONVIF subscription patterns and alert on anomalous payload structures or repeated subscription failures

Monitoring Recommendations

• Forward camera and network telemetry to a centralized logging platform for correlation between ONVIF requests and event service availability
• Monitor video management system (VMS) logs for unexpected loss of event channels from individual cameras
• Track authentication events to ONVIF interfaces and alert on credential use from unusual adjacent-network sources

How to Mitigate CVE-2026-6242

Immediate Actions Required

• Apply the latest TP-Link firmware for the Tapo C520WS v2 as published in the vendor release notes
• Restrict network access to the camera's ONVIF interface to authorized VMS hosts only using VLAN segmentation or firewall rules
• Rotate ONVIF credentials and enforce strong, unique passwords on every camera
• Verify event notification functionality after patching to confirm service stability

Patch Information

TP-Link publishes firmware updates for the Tapo C520WS v2 through its support portal. Consult the TP-Link Firmware Release Notes and the TP-Link Support FAQ for the firmware version that addresses CVE-2026-6242 and for upgrade instructions.

Workarounds

• Place cameras on a dedicated, isolated network segment unreachable from general user or guest networks
• Disable ONVIF event subscriptions if real-time notifications are not required by the deployment
• Restrict ONVIF access through host-based access control lists on the VMS or recording server
• Monitor and automatically restart the event notification service to reduce the duration of any service outage