Which versions of Tapo C260 Firmware are affected by CVE-2026-0651?

TP-Link Tapo C260 v1 cameras are vulnerable to unauthenticated local filesystem access through a path traversal flaw, potentially exposing sensitive device data and configuration files.

How to fix or mitigate CVE-2026-0651?

Within 24 hours: Identify and inventory all TP-Link Tapo C260 v1 devices across the organization and isolate them to restricted network segments if possible. Within 7 days: Implement network access controls to limit local subnet connectivity to these devices and monitor for suspicious GET requests to unusual paths. Within 30 days: Contact TP-Link for patch timeline confirmation, evaluate replacement with patched hardware models, or conduct risk assessment to determine if devices can be safely decommissioned.

Tapo C260 Firmware CVE-2026-0651

Q: What is the CVSS score of CVE-2026-0651?

CVE-2026-0651 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Path Traversal (CWE-22)

2026-02-10 f23511db-6c3e-4e32-a477-6aa17d310630

TP-Link Path Traversal RCE Tapo C260 Firmware

6.9

CVSS 4.0 · Vendor: f23511db-6c3e-4e32-a477-6aa17d310630

Severity by source

Vendor (f23511db-6c3e-4e32-a477-6aa17d310630) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f23511db-6c3e-4e32-a477-6aa17d310630) · only source for this CVE.

CVSS VectorVendor: f23511db-6c3e-4e32-a477-6aa17d310630

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

MEDIUM 6.9

DescriptionCVE.org

On TP-Link Tapo C260 v1, path traversal is possible due to improper handling of specific GET request paths via https, allowing local unauthenticated probing of filesystem paths. An attacker on the local network can determine whether certain files exists on the device, with no read, write or code execution possibilities.

AnalysisAI

TP-Link Tapo C260 v1 firmware contains a path traversal vulnerability in HTTPS GET request handling that allows local network attackers to probe filesystem paths and determine file existence without authentication. While the vulnerability does not permit file read, write, or code execution, it enables information disclosure about the device's filesystem structure to unauthenticated local users. No patch is currently available.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Tapo C260 Firmware. On TP-Link Tapo C260 v1, path traversal is possible due to improper handling of specific GET request paths via https, allowing local unauthenticated probing of filesystem paths. An attacker on the local network can determine whether certain files exists on the device, with no read, write or code execution possibilities.