Loading story…
Security researcher Spaceraccoon disclosed an exploit chain affecting the TP-Link Tapo C260 camera that can be used to gain a shell on the device. The chain ties together CVE-2026-0651, CVE-2026-0652, and CVE-2026-0653, and public reporting describes the issues as enabling remote code execution against the webcam. A companion GitHub repository published by l0lsec provides a proof-of-concept implementation based on the research.
The public release of both the technical write-up and exploit code lowers the barrier for attackers targeting exposed or reachable Tapo C260 devices. For defenders, the disclosure means organizations and consumers using the camera should urgently identify affected deployments, restrict network exposure, monitor for signs of compromise, and apply any vendor fixes or mitigations as they become available.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository named "tapo-c260-rce" was published with a proof-of-concept exploit chain for the TP-Link Tapo C260 camera, referencing the same three CVEs and the underlying research by Spaceraccoon.
A Spaceraccoon blog post disclosed an exploit chain affecting the TP-Link Tapo C260 camera, describing how shell access could be obtained via CVE-2026-0651, CVE-2026-0652, and CVE-2026-0653.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
spaceraccoon.dev
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TP-Link patched two vulnerabilities in its Tapo C200 smart cameras that allow attackers on the same network to hijack an administrative session or disrupt the camera's HTTPS service. **CVE-2026-15315** allows replay of camera-generated authentication material in the local HTTPS management interface, potentially exposing live video, stored recordings, and administrative functions without the camera password. **CVE-2026-15316** allows an unauthenticated attacker to send an oversized encrypted Wi-Fi credential during onboarding and crash the HTTPS service. OPSWAT reported the issues to TP-Link on April 16; TP-Link confirmed them on July 10, assigned CVEs on August 13, and released the remediation in Tapo C200 firmware **V5_1.4.6** on August 18. OPSWAT also disclosed that it reported a separate critical, currently undisclosed flaw that could fully compromise a camera and establish a foothold on the local network; technical details remain withheld pending a fix.
Sep 16, 2026
Akamai’s Security Intelligence and Response Team (SIRT) disclosed a **critical remote command injection** vulnerability in *Vivotek* legacy IP camera firmware tracked as **CVE-2026-22755** (reported **CVSS 9.3**). The flaw enables **unauthenticated attackers to execute arbitrary commands as `root`** by abusing the camera’s file upload handling in the `upload_map.cgi` CGI endpoint, where a user-controlled filename is incorporated into a formatted string and then passed to a shell via `system()` without proper sanitization, allowing shell metacharacter injection (e.g., `;`). Technical reporting indicates exploitation hinges on crafting an upload that satisfies several implementation constraints (e.g., upload size limits and firmware validation behaviors) and invoking the upload path in a way that preserves required environment variables; researchers demonstrated command execution by embedding commands in the filename and observing `uid=0` output. The issue reportedly impacts **dozens of models (36 cited)** across multiple Vivotek product lines and is amplified by findings that some affected legacy devices may ship or operate **without passwords set by default**, increasing the likelihood of opportunistic compromise and downstream abuse (e.g., botnet recruitment and DDoS activity) in environments still running legacy surveillance infrastructure.
Jun 29, 2026
TP-Link has patched two vulnerabilities in **Kasa EC70 v4** and **EC71 v4** cameras, including the high-severity **`CVE-2026-9770`** flaw caused by a hardcoded private cryptographic key embedded in firmware. Because the same static key was stored in a read-only filesystem and shared across devices, an unauthenticated attacker on the same local network could extract it from the firmware image and use it against the cameras’ web management service, undermining the confidentiality of encrypted communications. The issue could enable passive traffic decryption, machine-in-the-middle interception, and capture of administrative credentials. TP-Link also fixed **`CVE-2026-13230`**, a lower-severity information disclosure bug that can reveal geolocation data through the devices’ local discovery mechanism without authentication. The affected products are vulnerable on firmware versions earlier than **2.4.0 Build 20260520 rel.4191**, and the company said it has found no evidence of active exploitation or any public proof-of-concept. Because both flaws require local network access, the exposure is most relevant to shared Wi-Fi environments or compromised devices already inside the network; users are advised to update camera firmware and the Kasa mobile app and to isolate IoT devices on a guest or segmented network.
Jul 17, 2026