Vulnerability details
CVE-2026-0654
TP-Link Systems Deco BE25
Command injection on TP-Link Deco BE25
CVSS 4.0
8.5High
Official description
Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.5High | 4.0 | CVEProject cvelistV5 (CNA) (TPLink) | CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| TP-Link Systems Inc. | Deco BE25 v1.0 | v ≤ 1.1.1 Build 20250822 | CVEProject cvelistV5 (CNA) |
References and advisories
4
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-02
- Last updated
- 2026-03-11
- State
- Published
- Assigner (CNA)
- TPLink
Exploit prediction (EPSS)
0.31%
Probability of exploitation in 30 days
24.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')