PT-2026-7323 · Tp Link · Tapo C260

Spaceraccoon · Published 2026-02-10 · Updated 2026-03-10 · CVE-2026-0652

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TP-Link Tapo C260 version 1

Description A command injection issue exists in the TP-Link Tapo C260 v1 due to insufficient input validation of certain POST parameters during configuration synchronization. A successful exploit by an authenticated attacker could allow for the execution of arbitrary system commands, potentially leading to a complete compromise of the device, impacting confidentiality, integrity, and availability. The vulnerability allows an attacker to execute arbitrary code through specific POST request parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-01857

CVE-2026-0652

Affected Products

Tapo C260

References · 9

• https://bdu.fstec.ru/vul/2026-01857 · Security Note
• https://tp-link.com/en/support/download/tapo-c260/v1 · Patch
• https://tp-link.com/us/support/faq/4960 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0652 · Security Note
• https://tp-link.com/us/support/download/tapo-c260/v1 · Patch
• https://osv.dev/vulnerability/CVE-2026-0652 · Vendor Advisory
• https://twitter.com/ksg93rd/status/2031399268980862988 · Twitter Post
• https://twitter.com/Dinosn/status/2029864460861489371 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1rmc5pq/getting_a_shell_on_the_tapo_c260_webcam · Reddit Post