CVE-2026-0654
OS Command Injection in TP-Link Deco BE25 Admin Interface
Publication date: 2026-03-02
Last updated on: 2026-03-06
Assigner: TPLink
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tp-link | deco_be25_firmware | to 1.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-0654 is a command injection vulnerability in the administration web interface of the TP-Link Deco BE25 device, specifically affecting versions up to v1.1.1 Build 20250822.
The vulnerability occurs due to improper input handling, which allows an authenticated adjacent attacker to submit crafted input that is executed as part of an operating system command.
This means the attacker can execute arbitrary commands on the device, potentially compromising its confidentiality, integrity, and availability.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability allows an authenticated adjacent attacker to execute arbitrary OS commands on the affected TP-Link Deco BE25 device.'}, {'type': 'paragraph', 'content': "As a result, the attacker can impact the device's confidentiality, integrity, and availability, potentially leading to unauthorized access, data manipulation, or denial of service."}, {'type': 'paragraph', 'content': 'If exploited, this could disrupt your network operations and compromise sensitive information handled by the device.'}] [3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-0654 vulnerability on TP-Link Deco BE25 devices, immediately update the device firmware to the latest version provided by TP-Link.
- Download and install the latest firmware version, such as Deco BE25(SG)_V1_1.1.7 Build 20260114 or newer, which includes security improvements addressing this vulnerability.
- Ensure the firmware upgrade is performed from the official TP-Link website corresponding to your purchase region to avoid upgrade failures or warranty issues.
- Verify the hardware version of your device before upgrading to prevent installing incorrect firmware.
- Use a wired connection during the firmware upgrade process to avoid disconnections.
- Do not power off the device during the upgrade to prevent permanent damage.
- Stop all internet applications or disconnect the internet line before starting the upgrade.