An authentication bypass flaw in the DS configuration service of TP‑Link Tapo C520WS v2.6 allows an unauthenticated attacker to inject privileged actions into a JSON request, causing the device to perform restricted configuration changes without proper authorization. This vulnerability is a fault in request parsing and authorization logic, classified as CWE-287. The consequence is that an attacker can alter device settings or operate the device in unauthorized modes, potentially disrupting network services or compromising sensitive data stored on the device.

The affected system is the TP‑Link Tapo C520WS model v2.6, released by TP‑Link Systems Inc. No other vendors or product variants are listed as impacted in the available data.

The flaw carries a high CVSS score of 8.7, indicating significant impact if exploited. EPSS data is unavailable, but the weakness is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that publicly known exploits may not yet exist. The attack vector is inferred to be through the device’s local network interface, as the vulnerability requires sending a specially crafted HTTP request to the DS configuration service. Successful exploitation would not require prior authentication and would enable an attacker to modify device configuration settings.