Command Injection Vulnerability in TP-Link Tapo C260
CVE-2026-0652

8.7HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Tapo C260 V1
Vendor
CVE Published:
10 February 2026

What is CVE-2026-0652?

A command injection vulnerability exists in the TP-Link Tapo C260 v1 due to improper sanitization of certain POST parameters during configuration synchronization. This weakness enables authenticated attackers to execute arbitrary system commands, potentially leading to severe impacts on the device's confidentiality, integrity, and availability, resulting in full device compromise.

Affected Version(s)

Tapo C260 v1 0 < 1.1.9 Build 251226 Rel.55870n

References

https://www.tp-link.com/us/support/download/tapo-c260/v1/
patch
https://www.tp-link.com/en/support/download/tapo-c260/v1/
patch
https://www.tp-link.com/us/support/faq/4960/
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

spaceraccoon
.