tapo-c260-rce

Tapo C260 RCE 漏洞链（CVE-2026-0651 / CVE-2026-0652 / CVE-2026-0653） 针对 TP-Link Tapo C260 网络摄像头的概念验证漏洞利用链，通过串联由 Eugene Lim Spaceraccoon 发现的三个漏洞，实现从未认证到 root 权限的远程代码执行（RCE） 。 致谢 所有漏洞研究与发现均由Eugene Lim @spaceraccoon 完成。 本仓库是基于其公开文章实现的 PoC。如果你觉得有用，请购买他的著作： From Day Zero to Zero Day: A Hands-On Guide to...

Exploit for Path Traversal in Tp-Link Tapo_C260_Firmware

Tapo C260 RCE Chain CVE-2026-0651 / CVE-2026-0652 / CVE-2026-...

The vulnerability of TP-Link Tapo C260 IP camera’s microprogramming software, related to insufficient access control, allows a intruder to bypass existing security restrictions.

The vulnerability of TP-Link Tapo C260 IP camera’s microprogramming software is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...

The vulnerability of TP-Link Tapo C260’s microprogrammed software lies in the lack of measures to neutralize specific elements, allowing intruders to execute arbitrary codes.

The vulnerability of TP-Link Tapo C260 IP camera’s microprogramming software is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using certain POST requests...

The vulnerability of TP-Link Tapo C260 IP camera’s microprogramming software lies in the incorrect limitation of the path name to the directory. This allows a intruder to gain unauthorized access to the protected information.

The vulnerability of TP-Link Tapo C260 IP camera’s microprogramming software is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-0653

On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration...

CVE-2026-0652

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cau...

CVE-2026-0651

A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker...

CVE-2026-0652

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cau...

CVE-2026-0653

On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration...

CVE-2026-0652

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cau...

CVE-2026-0653

On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration...

CVE-2026-0651

A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An...

CVE-2026-0651 Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https

A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An...

CVE-2026-0651

CVE-2026-0651 is a path traversal vulnerability in TP-Link Tapo C260 v1, D235 v1, and C520WS v2.6 where the HTTP server mishandles GET paths: it normalizes paths, but if decoding of URL-encoded input fails it falls back to the raw path, enabling crafted URL-encoded traversal sequences to escape t...

CVE-2026-0651 Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https

A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An...

CVE-2026-0652 Remote Code Execution on TP-Link Tapo C260 by Guest User

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cau...

CVE-2026-0652

CVE-2026-0652 affects TP-Link Tapo C260 v1. The vulnerability is a command-injection flaw caused by improper sanitization of certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands, leading to high impact on confidentiality, in...

CVE-2026-0652 Remote Code Execution on TP-Link Tapo C260 by Guest User

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cau...

CVE-2026-0653

CVE-2026-0653 affects TP-Link Tapo C260 v1 and D235 v1. A guest-level authenticated user can bypass access controls by sending crafted requests to a synchronization endpoint, enabling modification of protected device settings with limited privileges. Root cause: insufficient access control leadin...