CVE-2026-0652

CVE-2026-0652 is a command injection flaw (CWE-78) in the firmware of TP-Link Tapo C260 cameras, specifically hardware version v1, caused by improper sanitization of certain POST parameters used during configuration synchronization. An attacker who already holds valid (low-privilege) credentials for the camera can submit crafted values in these parameters, causing arbitrary operating-system commands to be executed on the device. The injected commands run on the camera's underlying system, so the impact on confidentiality, integrity and availability is high and full device compromise is possible. Only users operating a TP-Link Tapo C260 v1 camera are affected. The flaw is not yet listed in CISA's KEV catalog and no public proof-of-concept is known, but its EPSS score of 21.9% (98th percentile) indicates an elevated probability of exploitation within the next 30 days.

What to do: Monitor the Tapo app and TP-Link's support/download site for a patched firmware release for the Tapo C260 (v1) and apply it as soon as it is published, since no fixed version is identified yet. Until then, restrict and strengthen credentials for the camera (strong, unique passwords), review which accounts have access, and disable remote/cloud access if it is not required. Ensure the camera is not directly reachable from the internet and sits behind a firewall with only necessary outbound connectivity.