The vulnerability originates from a logic flaw in the device’s API authorization mechanism that permits an attacker to craft requests that map legitimate methods to bypass whitelist restrictions. As a result, a restricted account can execute operations that it should not be allowed to, such as resetting the device, altering configuration settings, or disrupting normal operation. The effect is loss of device availability and integrity, effectively granting an attacker partial privileged control over the device. The weakness corresponds to improper authorization, matching CWE‑287.

The affected product is the TP‑Link Tapo C520WS v2. Only the second generation model of the Tapo C520WS running the original firmware is impacted; newer firmware revisions that have addressed the flaw are not mentioned in the supplied information.

The CVSS score of 7 indicates a high severity. For an attacker who already has credentials or access to a restricted account, the vulnerability can be leveraged via the device’s public API or local network interfaces. Although no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, the absence of exploitation data does not lower the risk, since the necessary resources to craft malicious requests are available through the exposed API and a logical bypass of the whitelist.