TP-Link Tapo C260 Command Injection Vulnerability Allowing Remote Code Execution
Vulnerability
A command injection vulnerability allowing remote code execution has been identified in the TP-Link Tapo C260 v1 camera. This issue arises from improper sanitization of certain POST parameters during configuration synchronization, which could enable an authenticated attacker to execute arbitrary system commands. The vulnerability has a high impact, potentially leading to full device compromise.
Impact
Exploitation of this vulnerability allows for arbitrary command execution on the device, with a high impact on the device's overall security and functionality, potentially leading to complete compromise of the device.
Remediation
Users are advised to update to the latest firmware version. Instructions for downloading the update are available on the TP-Link Tapo C260 v1 support page.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.