A stack‑based buffer overflow exists in the ONVIF DeleteUsers service of TP‑Link Tapo C520WS v2. When an authenticated user sends a request that contains too many delete identifiers, the service’s lack of input validation overflows stack memory. The overflow can cause the firmware to crash or deadlock, resulting in a denial of service that disables device management and monitoring functions.

TP‑Link Systems Inc. Tapo C520WS v2 devices are affected. Only the firmware version 2 of this model contains the vulnerability.

The CVSS score of 6.8 indicates moderate severity. EPSS data is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. Exploitation requires valid credentials to the ONVIF API, suggesting that an attacker must have authenticated access or compromise legitimate user accounts. The primary consequence is a service crash or deadlock that takes the camera out of operation, thereby disrupting surveillance and management.