CVE-2026-0651

medium

Description

On TP-Link Tapo C260 v1, path traversal is possible due to improper handling of specific GET request paths via https, allowing local unauthenticated probing of filesystem paths. An attacker on the local network can determine whether certain files exists on the device, with no read, write or code execution possibilities.

References

https://www.tp-link.com/us/support/faq/4960/

https://www.tp-link.com/us/support/download/tapo-c260/v1/

https://www.tp-link.com/en/support/download/tapo-c260/v1/

Details

Source: Mitre, NVD

Published: 2026-02-10

Updated: 2026-02-13

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00056