« Volver al listado

CVE-2026-34121

Estado: AnalizadaAlta (8.7)—

An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks.

Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:A (red adyacente) + vulnerabilidad de autenticación en servicio remoto permite bypass de autenticación sin privilegios previos, otorgando acceso no autenticado a acciones restringidas de configuración del dispositivo.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

Tp-link — Tapo C520ws Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-34121",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34121",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-02T17:58:42.273820Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "ADJACENT",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "affectedData": [
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "Tapo C520WS v2.6",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.2.4 Build 260326 Rel.24666n",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-02T18:16:28.990",
  "references": [
    {
      "url": "https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes",
      "tags": [
        "Release Notes"
      ],
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630"
    },
    {
      "url": "https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes",
      "tags": [
        "Release Notes"
      ],
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630"
    },
    {
      "url": "https://www.tp-link.com/us/support/faq/5047/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check.  An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks.\n\nSuccessful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de omisión de autenticación dentro del manejo HTTP del servicio de configuración DS en TP-Link Tapo C520WS v2.6 fue identificada, debido a una lógica de análisis y autorización inconsistente en las solicitudes JSON durante la verificación de autenticación. Un atacante no autenticado puede adjuntar una acción exenta de autenticación a una solicitud que contiene acciones privilegiadas de 'DS do', omitiendo las verificaciones de autorización.\n\nLa explotación exitosa permite la ejecución no autenticada de acciones de configuración restringidas, lo que puede resultar en una modificación no autorizada del estado del dispositivo."
    }
  ],
  "lastModified": "2026-07-24T21:10:00.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:tp-link:tapo_c520ws_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "710DD89A-E94F-4371-A03F-698C2F61D9C1",
              "versionEndExcluding": "1.2.4"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:tp-link:tapo_c520ws:2.6:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "72666951-E72F-4494-9A90-1F0B22E2F3CD"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"
}