CVE-2026-0651
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A path traversal vulnerability was identified in TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails, allowing bypass of directory restrictions.
Risk Assessment
Authenticated attackers may access sensitive system files and credentials, while unauthenticated attackers may access non-sensitive static assets, potentially leading to data leakage.
Recommendation
Update the camera firmware to the latest version and restrict access to the management interface.
Other vulnerabilities in TP-Link Tapo
See all- CVE-2026-34118Medium
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5 and C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation and insufficient boundary validation. An attacker on the same network segment could trigger heap memory corruption by sending crafted payloads.
- CVE-2023-27098High
The TP-Link Tapo APK up to version 2.12.703 uses hardcoded credentials for access to the login panel. This means anyone who knows these credentials can gain unauthorized access to the application.
Original NVD description (English source)
A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker can exploit this logic flaw by supplying crafted, URL encoded traversal sequences that bypass directory restrictions and allow access to files outside the intended web root. Successful exploitation may allow authenticated attackers to get disclosure of sensitive system files and credentials, while unauthenticated attackers may gain access to non-sensitive static assets.