CVE-2026-1315: fallo de gravedad alta en TP-Link Systems Inc. Tapo C220 v1
Unauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WS
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.6%
By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authentication or firmware integrity. An unauthenticated attacker can trigger a persistent denial of service, requiring a manual reboot or application initiated restart to restore normal device operation.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVEs relacionadas — TP-Link Systems Inc. Tapo C220 v1
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-0918HIGHNull Pointer Dereference in Tapo SmartCam HTTP Service on TP-Link Tapo C220 & C520WSEPSS 0.7%CVE-2026-0919HIGHUnauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WSEPSS 0.6%CVE-2026-8714HIGHDenial-of-Service Vulnerability in RTSP Input Handling on TP-Link's Tapo C520WSEPSS 0.2%CVE-2026-6240MEDIUMAuthenticated Stack-based Buffer Overflow in ONVIF DeleteUsers Service on TP-Link Tapo C520WSEPSS 0.2%CVE-2026-6239MEDIUMAuthenticated Stack-based Buffer Overflow in ONVIF CreateUsers Service in TP-Link Tao C520WSEPSS 0.2%CVE-2026-6242MEDIUMAuthenticated Format String Vulnerability in ONVIF Subscribe Service on TP-Link Tapo C520WSEPSS 0.2%