PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8714 TP-Link Systems Inc. CVE debrief

A denial-of-service vulnerability exists in the RTSP server component of TP-Link Tapo C520WS v2. The vulnerability is caused by improper handling of syntactically invalid input. Crafted inputs can trigger a processing error, causing the RTSP service to enter a non-responsive state. Successful exploitation may cause the RTSP to be in a denial-of-service condition.

Vendor
TP-Link Systems Inc.
Product
Tapo C520WS v2
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-06-05
Advisory published
2026-06-05
Advisory updated
2026-06-05

Who should care

Users of TP-Link Tapo C520WS v2 should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity. It can be exploited remotely with low attack complexity and no privileges required.

Defensive priority

HIGH

Recommended defensive actions

  • Apply firmware updates from TP-Link if available. Refer to resourceLinkAnnotations 'ref-4', 'ref-5', and 'ref-6' for more information.
  • Restrict access to the RTSP server to trusted sources only.
  • Monitor the RTSP server for unusual activity and implement logging and alerting mechanisms.

Evidence notes

The vendor of the affected product is likely TP-Link, based on evidence from the source item.

Official resources

CVE-2026-8714 was published on 2026-06-05T17:17:04.097Z and modified on 2026-06-05T19:03:48.933Z.