Vulnerability Description
Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tp-Link | Deco Be25 Firmware | <= 1.1.1 |
| Tp-Link | Deco Be25 | 1.0 |
Related Weaknesses (CWE)
References
- https://www.tp-link.com/en/support/download/deco-be25/#FirmwareProduct
- https://www.tp-link.com/sg/support/download/deco-be25/#FirmwareProduct
- https://www.tp-link.com/us/support/download/deco-be25/v1/#FirmwareProduct
- https://www.tp-link.com/us/support/faq/4993/Vendor Advisory
FAQ
What is CVE-2026-0654?
CVE-2026-0654 is a vulnerability with a CVSS score of 8.0 (HIGH). Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbi...
How severe is CVE-2026-0654?
CVE-2026-0654 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-0654?
Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link Deco Be25 Firmware, Tp-Link Deco Be25.