PT-2026-22661 · Tp Link · Tp-Link Deco Be25

Caprinuxx · Published 2026-03-02 · Updated 2026-03-02 · CVE-2026-0654

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions TP-Link Deco BE25 versions through 1.1.1 Build 20250822

Description A flaw exists in the administration web interface of the device that allows crafted input to be executed as part of an OS command. An authenticated attacker in a nearby network can potentially execute arbitrary commands through a specially crafted configuration file. This could compromise the confidentiality, integrity, and availability of the device.

Recommendations Update TP-Link Deco BE25 to a version later than 1.1.1 Build 20250822.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-0654

Affected Products

Tp-Link Deco Be25

References · 9

• https://tp-link.com/us/support/faq/4993 · Vendor Advisory
• https://tp-link.com/sg/support/download/deco-be25/#Firmware · Patch
• https://tp-link.com/en/support/download/deco-be25/#Firmware · Patch
• https://tp-link.com/us/support/download/deco-be25/v1/#Firmware · Patch
• https://osv.dev/vulnerability/CVE-2026-0654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0654 · Security Note
• https://twitter.com/VulmonFeeds/status/2028599080771895617 · Twitter Post
• https://twitter.com/CVEnew/status/2028532403866656859 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028533428719649252 · Twitter Post