Vulnerability Description
On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tp-Link | Tapo C260 Firmware | < 1.1.9 |
| Tp-Link | Tapo C260 | 1 |
Related Weaknesses (CWE)
References
- https://www.tp-link.com/en/support/download/tapo-c260/v1/Product
- https://www.tp-link.com/us/support/download/tapo-c260/v1/Product
- https://www.tp-link.com/us/support/faq/4960/Vendor Advisory
FAQ
What is CVE-2026-0652?
CVE-2026-0652 is a vulnerability with a CVSS score of 8.8 (HIGH). On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbi...
How severe is CVE-2026-0652?
CVE-2026-0652 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-0652?
Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link Tapo C260 Firmware, Tp-Link Tapo C260.