CVE-2026-0652

Remote Code Execution on TP-Link Tapo C260 by Guest User

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

Affected

TP-Link Systems Inc. · Tapo C260 v1

CVSS v4.0 CNA

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

23.31% chance of exploitation in the next 30 days, 98th percentile

Published

2026-02-10

Updated

2026-02-11

Proof-of-concept exploits (1)

• l0lsec/tapo-c260-rce2★ · 2026-03-06

Security advisories

• https://www.tp-link.com/us/support/faq/4960
• https://www.tp-link.com/en/support/download/tapo-c260/v1
• https://www.tp-link.com/us/support/download/tapo-c260/v1

References

• CVE Record
• NVD entry

Related

• CVE-2019-18394
• CVE-2021-3262
• CVE-2026-0651
• CVE-2026-0653
• CVE-2026-12960