Threats Tagged 'cve-2026-34121'

CVE-2026-34121 is an authentication bypass vulnerability in TP-Link Tapo C520WS version 2.6. It arises from inconsistent parsing and authorization logic in JSON requests handled by the device's DS configuration service. An unauthenticated attacker can exploit this flaw by appending an authentication-exempt action to requests containing privileged actions, thereby bypassing authorization checks. Successful exploitation allows unauthorized execution of restricted configuration changes on the device, potentially altering its state without proper credentials. The vulnerability has a high severity rating with a CVSS score of 8.7. No official patch or remediation guidance is currently provided by the vendor. The device is not a cloud service, so remediation depends on vendor updates or user action. There are no known exploits in the wild at this time.