The vulnerability is an authenticated format string flaw in the ONVIF Subscribe service of the TP‑Link Tapo C520WS v2. Improper handling of externally supplied parameters in formatting functions enables an attacker to insert crafted format strings into event subscription requests or notification generation, causing the event notification process to terminate and the real‑time alarm functionality to fail.

TP‑Link Systems Inc. product Tapo C520WS version 2. No other vendors or product versions are listed as affected.

The CVSS score is 6.8, indicating a moderate impact when the flaw is exploited. EPSS information is unavailable, so the likelihood of exploitation cannot be quantified, and the vulnerability is not currently listed in CISA's KEV catalog. The description indicates that the attack requires authentication, suggesting the vector involves a network-facing service that an authenticated user can reach. Successful exploitation would lead to denial of real‑time alarm and event notification capabilities. No public exploits are known at this time.