CVE-2026-0653

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0653", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-01-06T18:19:03.788Z", "datePublished": "2026-02-10T17:27:31.365Z", "dateUpdated": "2026-08-04T17:31:24.227Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-08-04T17:31:24.227Z"}, "title": "Insecure Access Control on TP-Link Tapo D235 and C260", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C260 v1", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.9 Build 251226 Rel.55870n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Tapo D235 v1", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.2 Build 260210 Rel.27165n", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "On TP-Link Tapo C260 v1 and D235 v1, a\u00a0guest\u2011level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "On TP-Link Tapo C260 v1 and D235 v1, a guest\u2011level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution."}]}], "references": [{"url": "https://www.tp-link.com/us/support/download/tapo-c260/v1/", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tapo-c260/v1/", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/4960/", "tags": ["vendor-advisory"]}, {"url": "https://www.tp-link.com/en/support/download/tapo-d235/", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "spaceraccoon", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:07:58.044112Z", "id": "CVE-2026-0653", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T14:15:13.215Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0653", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:07:58.044112Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:08:15.918Z"}}], "cna": {"title": "Insecure Access Control on TP-Link Tapo D235 and C260", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "spaceraccoon"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C260 v1", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.9 Build 251226 Rel.55870n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Tapo D235 v1", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.2 Build 260210 Rel.27165n", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/us/support/download/tapo-c260/v1/", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tapo-c260/v1/", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/4960/", "tags": ["vendor-advisory"]}, {"url": "https://www.tp-link.com/en/support/download/tapo-d235/", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "On TP-Link Tapo C260 v1 and D235 v1, a\u00a0guest\u2011level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.", "supportingMedia": [{"type": "text/html", "value": "On TP-Link Tapo C260 v1 and D235 v1, a guest\u2011level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-08-04T17:31:24.227Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0653", "state": "PUBLISHED", "dateUpdated": "2026-08-04T17:31:24.227Z", "dateReserved": "2026-01-06T18:19:03.788Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-02-10T17:27:31.365Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tapo C260 v1", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.1.9 Build 251226 Rel.55870n", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Tapo D235 v1", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.2.2 Build 260210 Rel.27165n", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tapo_c260_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD5A8252-3DA6-4C0D-AF45-F19BCBDBEF95", "versionEndExcluding": "1.1.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tapo_c260:1:*:*:*:*:*:*:*", "matchCriteriaId": "26590B2F-AD6F-467B-813C-18972794C1F6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On TP-Link Tapo C260 v1 and D235 v1, a\u00a0guest\u2011level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution."}, {"lang": "es", "value": "En TP-Link Tapo C260 v1, un usuario autenticado con nivel de invitado puede eludir las restricciones de acceso previstas enviando solicitudes manipuladas a un endpoint de sincronizaci\u00f3n. Esto permite la modificaci\u00f3n de la configuraci\u00f3n protegida del dispositivo a pesar de los privilegios limitados. Un atacante puede cambiar par\u00e1metros de configuraci\u00f3n sensibles sin autorizaci\u00f3n, resultando en una manipulaci\u00f3n no autorizada del estado del dispositivo, pero no en la ejecuci\u00f3n completa de c\u00f3digo."}], "id": "CVE-2026-0653", "lastModified": "2026-06-17T10:11:09.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0653", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T15:07:58.044112Z", "version": "2.0.3"}}]}, "published": "2026-02-10T18:16:22.257", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/tapo-c260/v1/"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/tapo-d235/"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/us/support/download/tapo-c260/v1/"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Vendor Advisory"], "url": "https://www.tp-link.com/us/support/faq/4960/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.1.9 Build 251226 Rel.55870n)"}}], "product": "tapo_c260_v1", "vendor": "tp-link"}], "analysis": {"en": {"generated_at": "2026-04-16T06:57:00.838365+00:00", "value": {"mitigation_remediation": ["Download and install the latest firmware for Tapo C260 v1 and Tapo D235 v1 from the TP\u2011Link support site.", "Reboot the devices to apply the firmware update and enable the fixed access control logic.", "If guest accounts are not required, disable or delete them to eliminate the attack surface."], "summary": {"action": "Patch Now", "impact": "Unauthorized configuration modification via access control bypass"}, "threat_synthesis": {"affected_systems": "TP\u2011Link Systems Inc. \u2013 Tapo C260 v1 and Tapo D235 v1 are susceptible to this access control weakness.", "description_and_impact": "A guest\u2011level authenticated user on TP\u2011Link Tapo C260 v1 and D235 v1 can send crafted requests to a synchronization endpoint and modify protected device settings. The flaw allows unauthorized configuration changes but does not result in full code execution.", "risk_and_exploitability": "The vulnerability has a CVSS score of 7.2 and an EPSS of less than 1\u202f%. It is not listed in the CISA KEV catalog. Because the attack requires a valid guest credential and network access to the device\u2019s synchronization endpoint, exploitation is possible over the network but is considered low probability. The impact is the ability to alter device state without authorization, which undermines device integrity but does not expose other higher\u2011level privileges."}}}}, "created": "2026-02-11T21:57:21.515947+00:00", "updated": "2026-04-16T07:00:10.998974+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$tapo_c260_v1"]}