CVE-2026-0652

8.7 highEPSS 23%

High (8.7) in tp-link tapo c260 firmware. EPSS 23% chance of exploitation in the next 30 days.

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 23% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2026-02-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tp-link:tapo_c260_firmware

References

https://www.tp-link.com/en/support/download/tapo-c260/v1/
https://www.tp-link.com/us/support/download/tapo-c260/v1/
https://www.tp-link.com/us/support/faq/4960/

Check your stack JSON