CVE-2026-0653

Insecure Access Control on TP-Link Tapo D235 and C260

State: Published
Severity: 7.2 High
Published: Feb 10, 2026
Updated: Aug 4, 2026
Reserved: Jan 6, 2026

Description

On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.

Scores

CVSS	Score	Vector	Source
4.0	7.2 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N	TPLink

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
Tapo C260 v1TP-Link Systems Inc.	before 1.1.9 Build 251226 Rel.55870nAffected
Tapo D235 v1TP-Link Systems Inc.	before 1.2.2 Build 260210 Rel.27165nAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.