Vulnerability · Published Mar 2, 2026 · Assigned by TPLink

CVE-2026-0654Command injection on TP-Link Deco BE25

High 8.5

In plain English

A high-severity OS command injection in Deco BE25 v1.0 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	Deco BE25 v1.0	0 – through 1.1.1 Build 20250822

Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

In plain English

Official description

Affected products (as reported)

References