TP-Link Tapo c260 Firmware vulnerabilities

3 CVEs affecting TP-Link Tapo c260 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-0653, published 2026-02-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-0652, published 2026-02-10. High severity, CVSS 8.8. EPSS: 23.3% chance of exploitation in the next 30 days. On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute…
CVE-2026-0653, published 2026-02-10. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of…
CVE-2026-0651, published 2026-02-10. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before…