Exploit for Path Traversal in Tp-Link Tapo_C260_Firmware

Tapo C260 RCE Chain CVE-2026-0651 / CVE-2026-0652 / CVE-2026-...

TP-Link Omada EAP610 安全漏洞

The TP-Link Omada EAP610 is a wireless access point device manufactured by TP-Link Corporation. Versions of the TP-Link Omada EAP610 prior to version 1.6.0 contained security vulnerabilities. These vulnerabilities stemmed from improper handling of specially crafted requests by the HTTP service,...

CVE-2026-0654

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availabili...

CVE-2026-0654 Command injection on TP-Link Deco BE25

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availabili...

CVE-2026-0654

CVE-2026-0654 describes an OS command injection in the TP-Link Deco BE25 v1.0 administration web interface. The root cause is improper input handling that allows crafted input via a configuration file to be executed, enabling an authenticated adjacent attacker to run arbitrary commands. Affected ...

CVE-2026-0654 Command injection on TP-Link Deco BE25

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availabili...

CVE-2026-0654

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availabili...

CVE-2026-0655 Path Traversal on TP-Link Deco BE25

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in TP-Link Deco BE25 v1.0 web modules allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822...

CVE-2026-0655

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in TP-Link Deco BE25 v1.0 web modules allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822...

CVE-2026-0655

CVE-2026-0655 affects TP-Link Deco BE25 v1.0 (web modules) up to firmware 1.1.1 Build 20250822. The issue is a path traversal vulnerability that allows an authenticated adjacent attacker to read arbitrary files or cause a denial of service. Connected sources confirm the vulnerable product/version...

TP-Link Deco BE25 安全漏洞

The TP-Link Deco BE25 is a router produced by the TP-Link company. The TP-Link Deco BE25 v1.0, 1.1.1 Build 20250822, and earlier versions have security vulnerabilities. These vulnerabilities stem from improper handling of inputs in the management web interface, which may allow authenticated...

CVE-2025-9292

A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful...

CVE-2025-9292

A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful...

TP-Link Omada Cloud Controller 安全漏洞

TP-Link Omada Cloud Controller is a central management software developed by TP-Link Corporation. There is a security vulnerability in TP-Link Omada Cloud Controller, which stems from lax Web security configurations. This vulnerability may allow bypass of cross-domain restrictions that are enforc...

TP-LINK Tapo 安全漏洞

TP-LINK Tapo is a series of secure Wi-Fi cameras produced by TP-LINK Corporation. TP-LINK Tapo has a security vulnerability, which stems from issues with the certificate verification logic. This vulnerability may allow applications to accept identities of servers that are untrusted or not properl...

CVE-2026-1571

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended...

CVE-2026-0652

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cau...

CVE-2026-0651

A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker...

CVE-2026-1571

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended...

CVE-2026-1571 Reflected XSS Vulnerability on TP-Link Archer C60

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended...