CVE-2026-0653 json
Insecure Access Control on TP-Link Tapo D235 and C260
published 2026-02-10 8 mo ago modified 2026-08-04 3 mo ago also EUVD-2026-7070
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.
Patch / fix
- TP-Link Systems Inc. Tapo C260 v1 1.1.9 Build 251226 Rel.55870n
- TP-Link Systems Inc. Tapo D235 v1 1.2.2 Build 260210 Rel.27165n
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected products
- TP-Link Systems Inc. Tapo C260 v1
- TP-Link Systems Inc. Tapo D235 v1
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
tp-link.com
/us/support/download/tapo-c260/v1/
patch, product
-
tp-link.com
/en/support/download/tapo-c260/v1/
patch, product
-
tp-link.com
/en/support/download/tapo-d235/
patch
-
tp-link.com
/us/support/faq/4960/
vendor-advisory
Sources
- CVE List CVE-2026-0653
- NVD CVE-2026-0653
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.