PT-2026-22661 · Tp Link · Tp-Link Deco Be25

Caprinuxx · Publicado 2026-03-02 · Atualizado 2026-03-02 · CVE-2026-0654

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions TP-Link Deco BE25 versions through 1.1.1 Build 20250822

Description A flaw exists in the administration web interface of the device that allows crafted input to be executed as part of an OS command. An authenticated attacker in a nearby network can potentially execute arbitrary commands through a specially crafted configuration file. This could compromise the confidentiality, integrity, and availability of the device.

Recommendations Update TP-Link Deco BE25 to a version later than 1.1.1 Build 20250822.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-0654

Produtos afetados

Tp-Link Deco Be25

Referências · 9

• https://tp-link.com/us/support/faq/4993 · Aviso do Fabricante
• https://tp-link.com/sg/support/download/deco-be25/#Firmware · Correção
• https://tp-link.com/en/support/download/deco-be25/#Firmware · Correção
• https://twitter.com/VulmonFeeds/status/2028599080771895617 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2028532403866656859 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2028533428719649252 · Publicação no Twitter
• https://tp-link.com/us/support/download/deco-be25/v1/#Firmware · Correção
• https://osv.dev/vulnerability/CVE-2026-0654 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-0654 · Nota de Segurança