CVE-2026-0651: TP-Link Tapo C260 Path Traversal Flaw

CVE-2026-0651 Overview

CVE-2026-0651 is a path traversal vulnerability affecting the TP-Link Tapo C260 v1 security camera. The vulnerability stems from improper handling of specific GET request paths via HTTPS, allowing local unauthenticated attackers to probe filesystem paths on the device. An attacker on the local network can determine whether certain files exist on the device without requiring any authentication.

Critical Impact

Local network attackers can enumerate filesystem paths on vulnerable TP-Link Tapo C260 cameras, potentially revealing device configuration structure and aiding in further attack reconnaissance.

Affected Products

• TP-Link Tapo C260 v1 (all firmware versions prior to patched release)
• TP-Link Tapo C260 devices accessible via HTTPS on local network

Discovery Timeline

• 2026-02-10 - CVE CVE-2026-0651 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-0651

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in the web interface of the TP-Link Tapo C260 v1 security camera. The device's HTTPS handler fails to properly sanitize user-supplied input in GET request paths, enabling directory traversal sequences to bypass intended path restrictions. While the vulnerability is limited to information disclosure regarding file existence, it provides attackers with valuable reconnaissance capabilities that could inform subsequent attack strategies.

The vulnerability requires network adjacency, meaning an attacker must be on the same local network as the vulnerable camera. No authentication is required to exploit this flaw, making any device on the local network a potential attack vector. The impact is constrained to filesystem probing—attackers cannot read file contents, write to the filesystem, or achieve code execution through this vulnerability alone.

Root Cause

The root cause is improper input validation (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in the camera's embedded web server. The HTTPS request handler does not adequately sanitize path traversal sequences such as ../ in GET requests, allowing attackers to reference paths outside the intended web root directory. This enables enumeration of filesystem structure through response behavior analysis.

Attack Vector

The attack vector is network-based, requiring the attacker to have local network access to the target camera. An attacker crafts malicious HTTPS GET requests containing path traversal sequences to probe for the existence of specific files or directories on the device's filesystem.

The exploitation involves sending specially crafted GET requests with directory traversal patterns (e.g., /../../../etc/passwd) to the camera's HTTPS interface. By analyzing the HTTP response differences (such as distinct error codes or response timing), an attacker can infer whether targeted paths exist on the filesystem. This information disclosure can reveal the device's operating system structure, configuration file locations, and other sensitive path information useful for planning more sophisticated attacks.

Detection Methods for CVE-2026-0651

Indicators of Compromise

• Unusual HTTPS GET requests to Tapo C260 cameras containing path traversal sequences (../, ..%2f, %2e%2e/)
• Multiple sequential requests probing different filesystem paths from a single source
• HTTP requests targeting non-standard paths on the camera's web interface
• Network traffic patterns indicating systematic directory enumeration attempts

Detection Strategies

• Monitor network traffic for HTTPS requests to IoT camera devices containing encoded or unencoded directory traversal characters
• Implement network intrusion detection rules to alert on path traversal patterns in HTTP/HTTPS requests to known IoT device IP addresses
• Deploy network segmentation monitoring to detect unexpected traffic patterns targeting IoT devices from non-management hosts

Monitoring Recommendations

• Enable detailed logging on network security appliances for traffic destined to IoT device segments
• Configure SIEM rules to correlate multiple path traversal attempts against IoT devices
• Implement anomaly detection for unusual access patterns to security camera management interfaces
• Regularly audit network access logs for connections to Tapo cameras from unauthorized hosts

How to Mitigate CVE-2026-0651

Immediate Actions Required

• Isolate TP-Link Tapo C260 cameras on a dedicated IoT VLAN with restricted access from general network segments
• Implement firewall rules to limit HTTPS access to cameras from only authorized management hosts
• Check for and apply the latest firmware updates from TP-Link
• Disable HTTPS web interface access if not required for camera management

Patch Information

TP-Link has published firmware updates to address this vulnerability. Users should visit the TP-Link Tapo C260 Firmware Download page to obtain the latest firmware version. Additional guidance is available in the TP-Link Tapo C260 FAQ. Apply firmware updates through the Tapo mobile application or via the device's web management interface.

Workarounds

• Segment IoT devices on isolated network VLANs to limit exposure from compromised hosts on the main network
• Implement strict firewall rules allowing only necessary management traffic to reach camera devices
• Use a VPN for remote camera access rather than exposing devices directly to broader network segments
• Disable unnecessary network services on the camera if configuration options permit

# Network segmentation example (iptables)
# Restrict access to IoT camera subnet (192.168.10.0/24) from main network
iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.10.0/24 -p tcp --dport 443 -j DROP
iptables -A FORWARD -s 192.168.1.100 -d 192.168.10.0/24 -p tcp --dport 443 -j ACCEPT
# Allow only management host (192.168.1.100) to access cameras on HTTPS