The vulnerability is a command injection flaw caused by inadequate sanitization of certain POST parameters used during configuration synchronization on the TP‑Link Tapo C260 v1. An attacker who can authenticate to the device can supply crafted inputs that are executed as arbitrary system commands, leading to full compromise of the device. The execution of unknown commands would compromise confidentiality, integrity, and availability of the device and any network resources it connects to.

TP‑Link Systems Inc. offers the Tapo C260 v1, the only product referenced in the vulnerability. No additional versions are listed as affected.

The CVSS base score of 8.7 indicates high severity, but the EPSS score of less than 1% shows a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. While specific exploitation steps are not detailed, the description indicates that an authenticated attacker (someone who has logged in or obtained credentials) can send malicious POST requests during configuration synchronization to trigger the command injection. This suggests that remote attackers may exploit the flaw over the network if they can authenticate, making the risk significant for devices exposed to the Internet.