Answer in brief
CVE-2026-0653 records a Unknown severity vulnerability in Insecure Access Control on TP-Link Tapo D235 and C260. The current sources do not mark it as known exploited. The current feed maps TP-Link Systems Inc./Tapo C260 v1 (generic), TP-Link Systems Inc./Tapo D235 v1 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps TP-Link Systems Inc./Tapo C260 v1 (generic), TP-Link Systems Inc./Tapo D235 v1 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| TP-Link Systems Inc./Tapo C260 v1generic | >=0 <1.1.9 Build 251226 Rel.55870n | 1.1.9 Build 251226 Rel.55870n |
| TP-Link Systems Inc./Tapo D235 v1generic | >=0 <1.2.2 Build 260210 Rel.27165n | 1.2.2 Build 260210 Rel.27165n |
Published upstream
Feb 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-0653 records a Unknown severity vulnerability in Insecure Access Control on TP-Link Tapo D235 and C260. The current sources do not mark it as known exploited. The current feed maps TP-Link Systems Inc./Tapo C260 v1 (generic), TP-Link Systems Inc./Tapo D235 v1 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps TP-Link Systems Inc./Tapo C260 v1 (generic), TP-Link Systems Inc./Tapo D235 v1 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| TP-Link Systems Inc./Tapo C260 v1generic | >=0 <1.1.9 Build 251226 Rel.55870n | 1.1.9 Build 251226 Rel.55870n |
| TP-Link Systems Inc./Tapo D235 v1generic | >=0 <1.2.2 Build 260210 Rel.27165n | 1.2.2 Build 260210 Rel.27165n |
Published upstream
Feb 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.
Quoted source text, attributed separately from HOL analysis.