Read the docs
TI-2026-00447 Aliases CVE-2026-0652GHSA-4f5q-mmm6-fj92

Remote Code Execution on TP-Link Tapo C260 by Guest User

Priority MEDIUM 60CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.23311 97th percentileScored 2026-11-07
Fix Fixed Tapo C260 v1 (TP-Link Systems Inc.): 1.1.9 Build 251226 Rel.55870n

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo C260 v1before 1.1.9 Build 251226 Rel.55870n1.1.9 Build 251226 Rel.55870nPatch availableCNA
  • Tapo C260 v1 VendorTP-Link Affected before 1.1.9 Build 251226 Rel.55870n Fixed in 1.1.9 Build 251226 Rel.55870n Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c260_firmware:*:*:*:*:*:*:*:*before 1.1.9VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_c260:1:*:*:*:*:*:*:*1Running onTP-Link
  • cpe:2.3:o:tp-link:tapo_c260_firmware:*:*:*:*:*:*:*:* Versions before 1.1.9 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_c260:1:*:*:*:*:*:*:* Versions 1 Running on ·TP-Link

Remediation

  • Fix · CNA Tapo C260 v1 (TP-Link Systems Inc.) Fixed in 1.1.9 Build 251226 Rel.55870n

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems Tapo C260 v1 — tp-link.com/us/support/faq/4960

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-00448 Insecure Access Control on TP-Link Tapo D235 and C260Priority LOW 32
    • TI-2026-00446 Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local httpsPriority LOW 30
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0652
  2. 2026-10-03 Alias added: GHSA-4f5q-mmm6-fj92

References

Patch 2

Advisory 1

  • TI-2026-00448 Insecure Access Control on TP-Link Tapo D235 and C260 CVSS 4.0HIGH 7.2
  • TI-2026-00446 Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences