How severe is CVE-2026-6241?

CVE-2026-6241 has a CVSS 4.0 base score of 6.8, rated medium severity.

Is CVE-2026-6241 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-6241?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-6241 have an EU (EUVD) identifier?

Yes. CVE-2026-6241 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34936.

When was CVE-2026-6241 published?

CVE-2026-6241 was published on 2026-06-06 and last updated on 2026-06-17.

CVE-2026-6241

CVE-2026-6241 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-134.

Key facts

Severity: Medium (CVSS 4.0 base score 6.8)
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-34936
Weakness: CWE-134
Published: 2026-06-06
Last modified: 2026-06-17

Description

An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in DoS condition that impacts normal device operation.

Frequently asked questions

What is CVE-2026-6241?: An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in DoS condition that impacts normal device operation.
How severe is CVE-2026-6241?: CVE-2026-6241 has a CVSS 4.0 base score of 6.8, rated medium severity.
Is CVE-2026-6241 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-6241?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-6241 have an EU (EUVD) identifier?: Yes. CVE-2026-6241 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34936.
When was CVE-2026-6241 published?: CVE-2026-6241 was published on 2026-06-06 and last updated on 2026-06-17.

References

Other CWE-134 vulnerabilities

CVE-2012-1851 — Critical (CVSS 10.0): Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2,…
CVE-2012-0242 — Critical (CVSS 10.0): Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary…
CVE-2011-2475 — Critical (CVSS 10.0): Format string vulnerability in ECTrace.dll in the iMailGateway service in the Internet Mail Gateway in OneBridge Server…
CVE-2011-1568 — Critical (CVSS 10.0): Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and…
CVE-2010-4235 — Critical (CVSS 10.0): Format string vulnerability in RealNetworks Helix Server 12.x, 13.x, and 14.x before 14.2, and Helix Mobile Server…
CVE-2011-0270 — Critical (CVSS 10.0): Format string vulnerability in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows…

Browse all CWE-134 vulnerabilities →