CVE-2026-34123: Whitelist Validation Bypass in TP-Link Tapo C520WS

Synopsis

An authorization bypass vulnerability affects the TP-Link Tapo C520WS v2 smart camera firmware. The device's API authorization logic can be manipulated by a restricted account holder to disguise sensitive operations as permitted ones, bypassing whitelist enforcement entirely. Successful exploitation allows an attacker to trigger unauthorized operations such as device resets, configuration changes, or service disruption. A patched-image rebuild at firmware version 1.2.6 Build 260528 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network, such as a local LAN or VPN segment, to reach the device's API.

• AuthenticationRequired

  A low-privilege restricted account (for example, a hub user account) is required to craft and send the bypass requests.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends crafted API requests directly without any user action.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental factors required.

Blast Radius

• Attacker triggers a full device reset, wiping configuration and returning the camera to factory defaults.
• Attacker pushes unauthorized configuration changes, such as altering network settings, stream access controls, or recording behavior.
• Attacker disrupts normal camera operation, causing loss of availability for monitoring or security functions dependent on the device.