CVE-2026-6239 Authenticated Stack-based Buffer Overflow in ONVIF CreateUsers Service in TP-Link Tao C520WS
An authenticated attacker can cause a denial of service in TP-Link Tapo C520WS cameras by triggering a stack-based buffer overflow in the ONVIF CreateUsers service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6239?
CVE-2026-6239 is a medium-severity memory corruption vulnerability in TP-Link Systems Inc. Tapo C520WS v2, published on 5 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A stack‑based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted ONVIF request containing an excessive number of user entries to trigger memory corruption.
Successful exploitation may cause the ONVIF management service to terminate unexpectedly, resulting in a denial‑of‑service (DoS) condition that disrupts device configuration and management functions.
Weakness: CWE-121
Which versions are affected by CVE-2026-6239?
How do I fix CVE-2026-6239?
No fix has been published for CVE-2026-6239 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-6239 being exploited?
There is no known exploitation of CVE-2026-6239 in the wild and no public exploit code.
Sources
Also known as GHSA-cpjh-84vm-rvxf.