CVE-2026-0652CWE-78

Remote Code Execution on TP-Link Tapo C260 by Guest User

High · published February 10, 2026

CVSS v4.0

8.7

EPSS

23%

Percentile

97.8

In the wild

Unconfirmed

What it is

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

The record

Technical detail

CVSS v4.0: 8.7 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS: 0.23311 · 97.8th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2026-02-10T17:27Z

EPSS history

Timeline

10 FEB 17:27Z
Remote Code Execution on TP-Link Tapo C260 by Guest User
cvelistv5