CVE-2026-0654

High CVSS: 8.5

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device.
This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.

Vendor

Tp-link

Product

Deco Be25 Firmware

CWE

CWE-78

Yayın Tarihi

2026-03-02 18:16:25

Güncelleme

2026-03-06 19:47:21

Source Identifier

f23511db-6c3e-4e32-a477-6aa17d310630

KEV Date Added

Kategoriler

CWE-78 Deco Be25 Firmware HIGH Tp-link 2026

Referanslar

https://www.tp-link.com/en/support/download/deco-be25/#Firmware https://www.tp-link.com/sg/support/download/deco-be25/#Firmware https://www.tp-link.com/us/support/download/deco-be25/v1/#Firmware https://www.tp-link.com/us/support/faq/4993/

Benzer Kayıtlar

High

CVE-2026-34122

A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling c…

High

CVE-2026-34124

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic.…

High

CVE-2026-34118

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 in the HTTP POST body parsing logi…

High

CVE-2026-34119

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when…

High

CVE-2026-34120

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of…

High

CVE-2026-34121

An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v…