An authenticated format string vulnerability exists in the ONVIF AddScopes method of the TP‑Link Tapo C520WS v2. User controlled scope parameters are passed directly to a formatting function without sanitization, allowing an attacker to inject format specifiers. This flaw can manipulate memory handling and cause the ONVIF management service to crash, resulting in a denial‑of‑service condition that disrupts normal device operation without granting arbitrary code execution.

TP‑Link Systems Inc. – Tapo C520WS v2. The vulnerability is limited to firmware that includes the ONVIF AddScopes implementation and requires authenticated access to the device’s ONVIF API.

The CVSS score is 6.8, indicating a medium severity impact. The EPSS score is not available, and the issue is not listed in CISA’s KEV. Because the flaw requires authenticated control of the ONVIF API, the attacker must first obtain valid credentials or have physical access to the device. Successful exploitation results in a service crash, causing a temporary outage. No remote code execution or data exfiltration is possible by the current patch. The risk is therefore confined to availability degradation for the affected device.