On TP-Link Tapo C260 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 10 Feb 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | On TP-Link Tapo C260 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution. | |
| Title | Insecure Access Control on TP-Link Tapo D235 and C260 | |
| Weaknesses | CWE-284 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: TPLink
Published:
Updated: 2026-02-10T17:27:31.365Z
Reserved: 2026-01-06T18:19:03.788Z
Link: CVE-2026-0653
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-02-10T18:16:22.257
Modified: 2026-02-10T21:51:48.077
Link: CVE-2026-0653
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses