An authentication bypass flaw exists in the DS configuration service of the TP‑Link Tapo C520WS firmware. The HTTP handler processes JSON requests inconsistently, allowing an attacker to append an authentication‑exempt action to a privileged request. The firmware then treats the request as authenticated and executes configuration changes that normally require authorization. This results in unauthorized modification of device settings, potentially altering device behavior without the owner’s consent.

The vulnerability affects TP‑Link Tapo C520WS devices running firmware version 2.6. No other TP‑Link products or firmware versions are listed as impacted in the available data.

The CVSS base score of 8.7 indicates a high severity vulnerability. The EPSS score of less than 1 % suggests that the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be network‑based: an unauthenticated attacker must be able to send crafted HTTP/JSON requests to the device to exploit the faulty request parsing and authorization logic.