This vulnerability is a heap-based buffer overflow (CWE-122) in the HTTP request parsing component of TP-Link Tapo C520WS firmware version 2.6. The flaw arises due to insufficient validation of write boundaries when handling segmented HTTP request bodies, allowing an attacker on the same local network segment to send maliciously crafted HTTP requests. These requests can cause write operations beyond the allocated heap buffer, leading to memory corruption. The impact is a denial-of-service condition where the device process crashes or becomes unresponsive. The CVSS 4.0 vector indicates the attack requires adjacent network access, no privileges, no user interaction, and results in high impact on availability.

Exploitation of this vulnerability causes denial-of-service by crashing or hanging the device process, rendering the affected TP-Link Tapo C520WS device unresponsive. There is no indication of code execution or data disclosure. The attack requires network adjacency and no privileges or user interaction, making it feasible in local network environments. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor TP-Link communications for updates. Network segmentation to restrict access to the device from untrusted local network segments may reduce exposure. No vendor advisory states that no action is required or that the issue is mitigated.