CVE-2026-0653: On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization…

PriorityP343medium6.5CVSS 3.1

AVNACLPRLUINSUCNIHAN

EPSS

0.39%

30.4th percentile

On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
tp-link	tapo_c260_firmware	< 1.1.9	1.1.9
tp-link_systems_inc	tapo_c260_v1	< 1.1.9 Build 251226 Rel.55870n	1.1.9 Build 251226 Rel.55870n
tp-link_systems_inc	tapo_d235_v1	< 1.2.2 Build 260210 Rel.27165n	1.2.2 Build 260210 Rel.27165n

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

nvdv4.07.2HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.