CVE-2026-0652 - Remote Code Execution on TP-Link Tapo C260 by Guest User

Back Back to CVE browser

HIGH

Remote Code Execution on TP-Link Tapo C260 by Guest User

Published Feb 10, 2026

8.7

HIGH

CVSS 4.0

EPSS 22.37%

Description

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

Affected products

Vendor TP-Link Systems Inc. Product Tapo C260 v1 Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.1.9 Build 251226 Rel.55870n

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TP-Link Systems Inc.

Tapo C260 v1

unaffected

Version	Status	Constraints
0	affected	<1.1.9 Build 251226 Rel.55870n

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

https://www.tp-link.com/en/support/download/tapo-c260/v1/
patchProduct
https://www.tp-link.com/us/support/download/tapo-c260/v1/
patchProduct
https://www.tp-link.com/us/support/faq/4960/
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://www.tp-link.com/en/support/download/tapo-c260/v1/		patchProduct
https://www.tp-link.com/us/support/download/tapo-c260/v1/		patchProduct
https://www.tp-link.com/us/support/faq/4960/		vendor-advisoryVendor Advisory