TP-Link Tapo C260 Access Control Bypass Vulnerability

An access control vulnerability has been identified in the TP-Link Tapo C260 v1 camera. A guest-level authenticated user can bypass access restrictions by sending crafted requests to a synchronization endpoint. This exploitation allows unauthorized modification of protected device settings, enabling changes to sensitive configuration parameters and manipulation of the device's state, although it does not result in full code execution.

Impact

Exploitation of this vulnerability allows for unauthorized changes to device settings, leading to unauthorized manipulation of the device's state.

Remediation

Users are advised to update to the latest firmware version. The latest firmware can be downloaded from the TP-Link Tapo C260 v1 support page on the TP-Link website.