RCE in Tp-Link Deco Be25
CVE-2026-0654
Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.003 (21.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Tp-link Deco_be25 — versions 1.0
- Tp-link Deco_be25_firmware
- Tp-link Systems Inc. Deco Be25 V1.0 — versions 0
Weakness classification (CWE)
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-0654?
- CVE-2026-0654 is a high-severity vulnerability in Tp-Link Deco Be25, classified under OS Command Injection. CVSS score: 8.0/10. Published 2026-03-02.
- How severe is CVE-2026-0654?
- High severity. CVSS v3 base score is 8.0 out of 10.