What is the CVSS score of CVE-2026-0652?

CVE-2026-0652 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Tapo C260 Firmware are affected by CVE-2026-0652?

TP-Link Tapo C260 v1 cameras contain a command injection vulnerability allowing authenticated attackers to execute arbitrary commands, potentially compromising video feeds, network integrity, and…

How to fix or mitigate CVE-2026-0652?

Within 24 hours: Inventory all TP-Link Tapo C260 v1 devices and isolate them on a restricted network segment with minimal trust relationships. Within 7 days: Contact TP-Link support for patch availability timeline and evaluate camera replacement options if patches are unavailable. Within 30 days: Either deploy patched firmware immediately upon release or decommission affected devices and migrate to alternative camera solutions with current security support.

Tapo C260 Firmware CVE-2026-0652

HIGH

OS Command Injection (CWE-78)

2026-02-10 f23511db-6c3e-4e32-a477-6aa17d310630

TP-Link Command Injection Tapo C260 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 8.8

DescriptionCVE.org

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

AnalysisAI

Authenticated attackers can execute arbitrary commands on TP-Link Tapo C260 v1 cameras through command injection in POST parameters during configuration synchronization, potentially achieving complete device compromise. The vulnerability stems from insufficient input validation and affects confidentiality, integrity, and availability with no patch currently available.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects the certain POST component of Tapo C260 Firmware. On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.