CVE-2026-0651
📋 TL;DR
This vulnerability allows attackers on the same local network to probe the TP-Link Tapo C260 v1 camera's filesystem to determine if specific files exist. It does not allow reading file contents, writing files, or executing code. Only users with TP-Link Tapo C260 v1 cameras on their local network are affected.
💻 Affected Systems
- TP-Link Tapo C260
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could map the device's filesystem structure, potentially identifying configuration files, firmware components, or other sensitive paths that could aid in further attacks.
Likely Case
Information disclosure about filesystem structure that could be used for reconnaissance in preparation for other attacks, but no direct data theft or system compromise.
If Mitigated
Minimal impact - attackers can only confirm file existence without accessing contents, limiting practical damage.
🎯 Exploit Status
Exploitation requires crafting specific GET requests to probe filesystem paths. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.tp-link.com/us/support/faq/4960/
Restart Required: No
Instructions:
Check TP-Link's support page for firmware updates. If available, download the latest firmware from the vendor website and follow their update instructions.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the camera on a separate VLAN or network segment to limit exposure to potential attackers.
Access Control Lists
allImplement network ACLs to restrict which devices can communicate with the camera.
🧯 If You Can't Patch
- Segment the camera network to limit exposure to trusted devices only
- Monitor network traffic for unusual GET requests to the camera
🔍 How to Verify
Check if Vulnerable:
Attempt to probe filesystem paths via crafted GET requests to the camera's HTTPS interface from the local network.Check Version:
Check firmware version in the camera's web interface or mobile app settings.Verify Fix Applied:
Test if filesystem path probing still works after applying any available firmware updates.📡 Detection & Monitoring
Log Indicators:
- Unusual GET requests with path traversal patterns in web server logs
Network Indicators:
- Multiple failed path probing attempts to the camera's HTTPS port
SIEM Query:
source_ip="camera_ip" AND http_method="GET" AND uri CONTAINS ".." OR uri CONTAINS "/etc/" OR uri CONTAINS "/proc/"