This vulnerability is a heap-based buffer overflow (CWE-122) in the HTTP POST body parsing logic of TP-Link Tapo C520WS v2.6. It occurs due to missing validation of remaining buffer capacity after dynamic memory allocation, leading to write operations beyond allocated buffer boundaries when processing crafted HTTP input. An attacker on the same network segment can exploit this to trigger heap memory corruption, causing the device process to crash or become unresponsive, resulting in a denial-of-service condition. The CVSS 4.0 vector indicates the attack requires adjacent network access with low complexity and no privileges or user interaction, and the impact is high on availability.

Exploitation causes denial-of-service by crashing or making the device process unresponsive. This impacts device availability but does not indicate code execution or data disclosure. The attack requires network adjacency and crafted HTTP POST requests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, restrict network access to the device to trusted users only and monitor for unusual HTTP POST traffic from adjacent network hosts.