What’s Vulnerable › Vulnerabilities

CVE-2026-0652: Remote Code Execution on TP-Link Tapo C260 by Guest User

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 23.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-10 · updated 2026-06-17
• Weakness: CWE-78

Description

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

Affected products

• TP-Link Systems Inc. Tapo C260 v1: before 1.1.9 — fixed in 1.1.9

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. Tapo C260 v1 1.1.9. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/tapo-c260/v1/
• https://www.tp-link.com/us/support/download/tapo-c260/v1/
• https://www.tp-link.com/us/support/faq/4960/

Get alerted when CVE-2026-0652 or the next vulnerability affects your stack