CVE-2026-100420
Received
Received - Intake
Authenticated Information Disclosure in Deco BE63 Cloud Client
Vulnerability report for CVE-2026-100420, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-21
Last updated on: 2026-10-21
Assigner: TPLink
Description
Description
A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.
Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| TP-Link | Systems | Inc. Deco BE63 V2.0 0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-202 | When trying to keep information confidential, an attacker can often infer some of the information by using statistics. |
