Access Bypass in TP-Link Tapo C260 Product
CVE-2026-0653

7.2HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Tapo C260 V1
Vendor
CVE Published:
10 February 2026

What is CVE-2026-0653?

The TP-Link Tapo C260 v1 is susceptible to an access bypass that allows guest-level authenticated users to send specially crafted requests to a synchronization endpoint. This vulnerability enables these users to bypass intended access restrictions and modify protected device settings, despite possessing limited user privileges. An unauthorized attacker can alter sensitive configuration parameters, leading to potential unauthorized manipulation of the device's state without achieving full code execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Tapo C260 v1 0 < 1.1.9 Build 251226 Rel.55870n

References

https://www.tp-link.com/us/support/download/tapo-c260/v1/
patch
https://www.tp-link.com/en/support/download/tapo-c260/v1/
patch
https://www.tp-link.com/us/support/faq/4960/
vendor-advisory

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

spaceraccoon
JSON
.