Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
| Date | Total | Labels |
|---|
| 2026-02-12 | 1 | General1 |
| 2026-03-06 | 1 | PoC1 |
| 2026-03-10 | 1 | Exploit1 |
Getting a Shell on the Tapo C260 Webcam (CVE-2026-0651, CVE-2026-0652, CVE-2026-0653) https://spaceraccoon.dev/getting-shell-tapo-c260-webcam/
Post summary
The post announces a Proof of Concept that achieves shell access on the Tapo C260 webcam, referencing three CVEs but providing no concrete exploit details or patches within the text.
#exploit #reversing 1⃣ Getting a Shell on the Tapo C260 Camera (CVE-2026-0651, CVE-2026-0652, CVE-2026-0653) https://spaceraccoon.dev/getting-shell-tapo-c260-webcam // Reverse-engineered Tapo C260 firmware reveals vulnerabilities enabling local file disclosure and full RCE through path traversal and configuration manipulation 2⃣ nginx UI Vulnerability https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762 // CVE-2026-27944 (9.8/10) 3⃣ Patch diff to SYSTEM https://www.elastic.co/security-labs/patch-diff-to-system // Researchers utilized LLMs and patch diffing to develop a reliable privilege escalation exploit for Windows DWM via a UAF, demonstrating AI's growing role in vulnerability discovery and exploitation 4⃣ Reverse engineering Claude's CVE-2026-2796 exploit https://red.anthropic.com/2026/exploit ]-> Claude Code skill to support Android app's reverse engineering https://github.com/SimoneAvogadro/android-reverse-engineering-skill
Post summary
The post lists several new CVEs, shares PoC links and detailed exploit information, but lacks evidence of active exploitation or vendor patches.
🚨 TP-Link Tapo #CVE-2026-0651 & #CVE-2026-0652: Unauthenticated RCE and File Disclosure in Millions of Smart Cameras — Full Technical Breakdown + Video https://undercodetesting.com/tp-link-tapo-cve-2026-0651-cve-2026-0652-unauthenticated-rce-and-file-disclosure-in-millions-of-smart-cameras-full-technical-breakdown-video/ Educational Purposes!
Post summary
The tweet links to a technical breakdown and video on TP‑Link Tapo cameras’ CVE‑2026‑0651 and CVE‑2026‑0652, detailing unauthenticated RCE and file disclosure.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | tp-link | tapo_c260 | 1 | - | - |
| OS | tp-link | tapo_c260_firmware | - | - | - |