CVE-2026-0653
Analyzed Analyzed - Analysis Complete
Access Control Bypass in TP-Link Tapo C260 Allows Unauthorized Settings Modification

Publication date: 2026-02-10

Last updated on: 2026-03-13

Assigner: TPLink

Description
On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-10
Last Modified
2026-03-13
Generated
2026-06-16
AI Q&A
2026-02-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-0653
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tp-link tapo_c260_firmware to 1.1.9 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects the TP-Link Tapo C260 v1 device, where a guest-level authenticated user can bypass intended access restrictions by sending specially crafted requests to a synchronization endpoint.

As a result, the attacker can modify protected device settings despite having limited privileges, allowing unauthorized changes to sensitive configuration parameters.

However, this vulnerability does not allow full code execution on the device.

Impact Analysis

An attacker exploiting this vulnerability can manipulate the device's state by changing sensitive configuration settings without authorization.

This unauthorized modification could lead to compromised device behavior, potential security risks, and loss of control over device functions.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart