Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: TP-Link Systems Tapo C260 v1 — tp-link.com/us/support/faq/4960 Clear all filters
TI-2026-00446 CVE-2026-0651 · GHSA-c348-hjj9-x39v

Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https

Priority LOW 32

A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests.

CVSS 4.0MEDIUM 6.9 Adjacent network Low privileges No interaction EPSS 0.00795 Published 2026-02-10 Fixed in 1.1.9 Build 251226 Rel.55870n, 1.2.2 Build 260210 Rel.27165n +2 CWE-22
TI-2026-00447 CVE-2026-0652 · GHSA-4f5q-mmm6-fj92

Remote Code Execution on TP-Link Tapo C260 by Guest User

Priority MEDIUM 60

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.23311 Published 2026-02-10 Fixed in 1.1.9 Build 251226 Rel.55870n CWE-78
TI-2026-00448 CVE-2026-0653 · GHSA-ghg5-7pjg-pp65

Insecure Access Control on TP-Link Tapo D235 and C260

Priority LOW 32

On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00439 Published 2026-02-10 Fixed in 1.1.9 Build 251226 Rel.55870n, 1.2.2 Build 260210 Rel.27165n CWE-284