CVE-2026-6240

Name of the Vulnerable Software and Affected Versions Tapo C520WS v2

Description A stack-based buffer overflow occurs in the ONVIF DeleteUsers service due to insufficient boundary checks when processing multiple user deletion parameters. An authenticated attacker can trigger this by sending a crafted request with an excessive number of identifiers to overflow the stack memory. This can lead to a service crash or deadlock, resulting in a Denial of Service (DoS) that impacts device management and monitoring functionality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.