2 lines
4.3 KiB
JSON
2 lines
4.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Tapo C260 v1","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.1.9 Build 251226 Rel.55870n","status":"affected","version":"0","versionType":"custom"}]}],"source":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:tp-link:tapo_c260_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"FD5A8252-3DA6-4C0D-AF45-F19BCBDBEF95","versionEndExcluding":"1.1.9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:tp-link:tapo_c260:1:*:*:*:*:*:*:*","matchCriteriaId":"26590B2F-AD6F-467B-813C-18972794C1F6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise."},{"lang":"es","value":"En TP-Link Tapo C260 v1, existe una vulnerabilidad de inyección de comandos debido a una sanitización inadecuada en ciertos parámetros POST durante la sincronización de la configuración. Un atacante autenticado puede ejecutar comandos de sistema arbitrarios con alto impacto en la confidencialidad, integridad y disponibilidad. Puede causar un compromiso total del dispositivo."}],"id":"CVE-2026-0652","lastModified":"2026-06-17T10:11:09.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0652","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-02-11T15:10:09.515483Z","version":"2.0.3"}}]},"published":"2026-02-10T18:16:22.127","references":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Product"],"url":"https://www.tp-link.com/en/support/download/tapo-c260/v1/"},{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Product"],"url":"https://www.tp-link.com/us/support/download/tapo-c260/v1/"},{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Vendor Advisory"],"url":"https://www.tp-link.com/us/support/faq/4960/"}],"sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary"}]}
|