What is CVE-2026-0652?

CVE-2026-0652 is a high-severity vulnerability in Tp-link Tapo_c260, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-02-10.

How severe is CVE-2026-0652?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Tp-link Tapo_c260

CVE-2026-0652

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.228 (97.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Tp-link Tapo_c260 — versions 1
Tp-link Tapo_c260_firmware
Tp-link Systems Inc. Tapo C260 V1 — versions 0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2026-0652?: CVE-2026-0652 is a high-severity vulnerability in Tp-link Tapo_c260, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-02-10.
How severe is CVE-2026-0652?: High severity. CVSS v3 base score is 8.8 out of 10.