CVE-2026-0652

High CVSS: 8.7

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

Vendor

Tp-link

Product

Tapo C260 Firmware

CWE

CWE-78

Yayın Tarihi

2026-02-10 18:16:22

Güncelleme

2026-02-13 20:45:16

Source Identifier

f23511db-6c3e-4e32-a477-6aa17d310630

KEV Date Added

Kategoriler

CWE-78 Tapo C260 Firmware HIGH Tp-link 2026

Referanslar

https://www.tp-link.com/en/support/download/tapo-c260/v1/ https://www.tp-link.com/us/support/download/tapo-c260/v1/ https://www.tp-link.com/us/support/faq/4960/

Benzer Kayıtlar

High

CVE-2026-34122

A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling c…

High

CVE-2026-34124

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic.…

High

CVE-2026-34118

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 in the HTTP POST body parsing logi…

High

CVE-2026-34119

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when…

High

CVE-2026-34120

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of…

High

CVE-2026-34121

An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v…