VulnerabilityAnalyzed

CVE-2026-0652

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization.

HIGH 8.7EPSS 21.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 21.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 21.93% probability · 98th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: tp-link/tapo c260 firmware
Source: f23511db-6c3e-4e32-a477-6aa17d310630

References

https://www.tp-link.com/en/support/download/tapo-c260/v1/Product
https://www.tp-link.com/us/support/download/tapo-c260/v1/Product
https://www.tp-link.com/us/support/faq/4960/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.