Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
Getting a Shell on the Tapo C260 Webcam (CVE-2026-0651, CVE-2026-0652, CVE-2026-0653) https://spaceraccoon.dev/getting-shell-tapo-c260-webcam/
Post summary
The post announces the discovery of a PoC that yields a remote shell on Tapo C260 webcams via CVE‑2026‑0651/0652/0653, but does not indicate active attacks or patches.
#exploit #reversing 1⃣ Getting a Shell on the Tapo C260 Camera (CVE-2026-0651, CVE-2026-0652, CVE-2026-0653) https://spaceraccoon.dev/getting-shell-tapo-c260-webcam // Reverse-engineered Tapo C260 firmware reveals vulnerabilities enabling local file disclosure and full RCE through path traversal and configuration manipulation 2⃣ nginx UI Vulnerability https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762 // CVE-2026-27944 (9.8/10) 3⃣ Patch diff to SYSTEM https://www.elastic.co/security-labs/patch-diff-to-system // Researchers utilized LLMs and patch diffing to develop a reliable privilege escalation exploit for Windows DWM via a UAF, demonstrating AI's growing role in vulnerability discovery and exploitation 4⃣ Reverse engineering Claude's CVE-2026-2796 exploit https://red.anthropic.com/2026/exploit ]-> Claude Code skill to support Android app's reverse engineering https://github.com/SimoneAvogadro/android-reverse-engineering-skill
Post summary
The post presents proof‑of‑concept and functional exploit details for several CVEs, including remote code execution on a Tapo camera and a privilege escalation on Windows, but it does not report active attacks or patches.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | tp-link | tapo_c260 | 1 | - | - |
| OS | tp-link | tapo_c260_firmware | - | - | - |