Vulnerability Description
TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tp-Link | Deco M5 Firmware | < 1.9.4 |
| Tp-Link | Deco M5 | 1.0 |
Related Weaknesses (CWE)
References
- https://www.tp-link.com/en/support/download/deco-m5/v1/#FirmwareProduct
- https://www.tp-link.com/us/support/download/deco-m5/v1/#FirmwareProduct
- https://www.tp-link.com/us/support/faq/5190/Vendor Advisory
FAQ
What is CVE-2026-5040?
CVE-2026-5040 is a vulnerability with a CVSS score of 6.7 (MEDIUM). TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force...
How severe is CVE-2026-5040?
CVE-2026-5040 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-5040?
Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link Deco M5 Firmware, Tp-Link Deco M5.