RCE in TP-Link Tapo C260
CVE-2026-0652
On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.219 (97.6th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.216 · newest: 0.219 · change: +0.004
Affected products
- TP-Link Tapo C260 — versions 1
- TP-Link Tapo C260 Firmware
- TP-Link Systems Inc. Tapo C260 V1 — versions 0
Weakness classification (CWE)
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-0652?
- CVE-2026-0652 is a high-severity vulnerability in TP-Link Tapo C260, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-02-10.
- How severe is CVE-2026-0652?
- High severity. CVSS v3 base score is 8.8 out of 10.