Read the docs
TI-2026-00448 Aliases CVE-2026-0653GHSA-ghg5-7pjg-pp65

Insecure Access Control on TP-Link Tapo D235 and C260

Priority LOW 32CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00439 38th percentileScored 2026-11-07
Fix Fixed Tapo C260 v1 (TP-Link Systems Inc.): 1.1.9 Build 251226 Rel.55870nTapo D235 v1 (TP-Link Systems Inc.): 1.2.2 Build 260210 Rel.27165n

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo C260 v1before 1.1.9 Build 251226 Rel.55870n1.1.9 Build 251226 Rel.55870nPatch availableCNA
TP-LinkTapo D235 v1before 1.2.2 Build 260210 Rel.27165n1.2.2 Build 260210 Rel.27165nPatch availableCNA
  • Tapo C260 v1 VendorTP-Link Affected before 1.1.9 Build 251226 Rel.55870n Fixed in 1.1.9 Build 251226 Rel.55870n Patch available CNA
  • Tapo D235 v1 VendorTP-Link Affected before 1.2.2 Build 260210 Rel.27165n Fixed in 1.2.2 Build 260210 Rel.27165n Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c260_firmware:*:*:*:*:*:*:*:*before 1.1.9VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_c260:1:*:*:*:*:*:*:*1Running onTP-Link
  • cpe:2.3:o:tp-link:tapo_c260_firmware:*:*:*:*:*:*:*:* Versions before 1.1.9 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_c260:1:*:*:*:*:*:*:* Versions 1 Running on ·TP-Link

Remediation

  • Fix · CNA Tapo C260 v1 (TP-Link Systems Inc.) Fixed in 1.1.9 Build 251226 Rel.55870n
  • Fix · CNA Tapo D235 v1 (TP-Link Systems Inc.) Fixed in 1.2.2 Build 260210 Rel.27165n

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems Tapo C260 v1, Tapo D235 v1 — tp-link.com/us/support/faq/4960

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-00447 Remote Code Execution on TP-Link Tapo C260 by Guest UserPriority MEDIUM 60
    • TI-2026-00446 Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local httpsPriority LOW 30
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0653
  2. 2026-10-03 Alias added: GHSA-ghg5-7pjg-pp65

References

Patch 3

Advisory 1

  • TI-2026-00447 Remote Code Execution on TP-Link Tapo C260 by Guest User CVSS 4.0HIGH 8.7
  • TI-2026-00446 Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences