CVE-2026-34127 is a stored cross-site scripting (XSS) vulnerability in the web management interface of the TP-Link TL-SG108PE v5 switch. It arises from improper sanitization of the SYSNAM configuration parameter during configuration file import. An attacker with administrator privileges can inject malicious scripts into the device configuration, which execute in the administrator's browser when viewing the affected interface. Exploitation could lead to session cookie theft, unauthorized configuration changes, or exposure of sensitive information. The vulnerability has a medium severity with a CVSS score of 5.3. No patch or official remediation guidance has been provided by the vendor as of the publication date. No known exploits are reported in the wild.
TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth communication during the initial setup phase is transmitted in cleartext without encryption. Bluetooth is only used during initialization.
An attacker within the Bluetooth range could exploit this behavior using Bluetooth sniffing or man-in-the-middle techniques, which may allow eavesdropping on Bluetooth communication, manipulate transmitted setup data and potentially gain unauthorized control of the device during initialization.
An attacker
within the Bluetooth range could exploit this behavior using Bluetooth sniffing
or man-in-the-middle techniques, which may allow eavesdropping on Bluetooth
communication, manipulate transmitted setup data and potentially gain
unauthorized control of the device during initialization.
D100C is the
chime delivered with your Tapo camera, and it is delivered with the following
Tapo products:
D130, D210, D235,
D225, TD21, TDB21 and TD25
CVE-2026-8697 is a high-severity vulnerability in TP-Link Archer C64 v1.0 where the debug SSH service does not enforce authentication rate-limiting. This allows an attacker with adjacent network access to perform unlimited brute-force attempts using the same credentials as the web interface. Successful exploitation can lead to administrative access, compromising the device's confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.
An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system commands through the web management interface. After successfully authenticating to the admin interface, an attacker can leverage the browser’s developer console by supplying a crafted input that is passed to backend system commands without adequate sanitization.
Successful exploitation enables execution of arbitrary commands with elevated privileges on the device, which may allow the attacker to start unauthorized services, modify system configuration, or otherwise fully compromise the router’s operating environment.
An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation.
Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability.
In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of diagnostic command usage information.
An authenticated attacker with administrative privileges could exploit this issue to confirm the presence of the diagnostic utility and view its valid command-line syntax and options. The exposed information is limited in scope and does not include sensitive system data.
TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the key predictable if device is left in default configuration. A network-adjacent attacker can exploit this weakness to gain unauthorized access to the protocol, read debug data, modify certain device configuration values, and trigger device reboot, resulting in loss of integrity and a denial-of-service condition.
CVE-2026-5363 is a medium-severity vulnerability affecting TP-Link Archer C7 v5 and v5.8 routers through build 20220715. The vulnerability arises from the use of inadequate encryption strength, specifically RSA-1024, to encrypt the admin password client-side before transmission during login. An adjacent attacker capable of intercepting network traffic could attempt to brute-force or factor the RSA-1024 key to recover the plaintext administrator password. This could lead to unauthorized access and compromise of the device configuration. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not affect cloud services and no known exploits are reported in the wild.
An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute arbitrary code when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow the attacker to modify device configuration, access sensitive information, or further compromise system integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files when a malicious configuration file is processed. Successful exploitation may allow unauthorized access to arbitrary files on the device, potentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed.
Successful
exploitation may allow unauthorized access to arbitrary files on the device,
potentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
An OS command injection vulnerability in the OpenVPN module
of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to trigger a segmentation fault and potentially execute arbitrary code via a specially crafted configuration file. Successful exploitation may cause a crash and could allow arbitrary code execution, enabling modification of device state, exposure of sensitive data, or further compromise of device integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent network may send a crafted HTTP request to cause buffer overflow and memory corruption, leading to system interruption or device reboot.
CVE-2026-34122 is a stack-based buffer overflow vulnerability in TP-Link Tapo C520WS v2.6 caused by insufficient input validation in a configuration handling component. An attacker can trigger this by providing an excessively long configuration parameter value, leading to a stack overflow. Successful exploitation results in a denial-of-service condition, causing the device to crash or reboot and impacting availability. There is no information on an available patch or vendor advisory. No known exploits are reported in the wild.
CVE-2026-34121 is an authentication bypass vulnerability in TP-Link Tapo C520WS version 2.6. It arises from inconsistent parsing and authorization logic in JSON requests handled by the device's DS configuration service. An unauthenticated attacker can exploit this flaw by appending an authentication-exempt action to requests containing privileged actions, thereby bypassing authorization checks. Successful exploitation allows unauthorized execution of restricted configuration changes on the device, potentially altering its state without proper credentials. The vulnerability has a high severity rating with a CVSS score of 8.7. No official patch or remediation guidance is currently provided by the vendor. The device is not a cloud service, so remediation depends on vendor updates or user action. There are no known exploits in the wild at this time.
CVE-2026-34120 is a heap-based buffer overflow vulnerability in TP-Link Tapo C520WS v2.6. It occurs during asynchronous parsing of local video stream content due to improper buffer boundary validation. An attacker on the same network segment can send crafted payloads to trigger heap memory corruption, leading to a denial-of-service (DoS) condition where the device process crashes or becomes unresponsive. The vulnerability has a high severity score of 7.1. No patch or official remediation information is currently available.
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing
loop
when appending segmented request bodies without
continuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input. An attacker
on the same network segment could trigger heap memory corruption conditions by
sending crafted payloads that cause write operations beyond allocated buffer
boundaries. Successful exploitation
causes a Denial-of-Service (DoS) condition, causing the device’s process to
crash or become unresponsive.
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5, C210 v3.6 and C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input.
An attacker
on the same network segment could trigger heap memory corruption conditions by
sending crafted payloads that cause write operations beyond allocated buffer
boundaries. Successful exploitation
causes a Denial-of-Service (DoS) condition, causing the device’s process to
crash or become unresponsive.
CVE-2026-4346 is a vulnerability in TP-Link TL-WR850N v3 routers that involves cleartext storage of administrative and Wi-Fi credentials in flash memory. The device’s serial interface remains enabled and is protected by weak authentication, allowing an attacker with physical access and serial port connectivity to extract sensitive information. Exploiting this vulnerability can lead to full administrative control of the router and unauthorized access to the wireless network. The CVSS score is 5.1, indicating a medium severity level. No patch or official remediation is currently documented.