CVE-2026-1315 json
Unauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WS
published 2026-01-27 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-4790
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authentication or firmware integrity. An unauthenticated attacker can trigger a persistent denial of service, requiring a manual reboot or application initiated restart to restore normal device operation.
Patch / fix
- TP-Link Systems Inc. Tapo C220 v1 1.4.2 Build 251112
- TP-Link Systems Inc. Tapo C520WS v2 1.2.3 Build 251114
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- TP-Link Systems Inc. Tapo C220 v1
- TP-Link Systems Inc. Tapo C520WS v2
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
tp-link.com
/us/support/download/tapo-c220/v1.60/
patch, product
-
tp-link.com
/en/support/download/tapo-c220/v1/
patch, product
-
tp-link.com
/us/support/download/tapo-c520ws/v2/
patch, product
-
tp-link.com
/en/support/download/tapo-c520ws/v2/
patch, product
-
tp-link.com
/us/support/faq/4923/
vendor-advisory
Sources
- CVE List CVE-2026-1315
- NVD CVE-2026-1315
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.