High severity · published Mar 2, 2026
CVE-2026-0654
Command injection on TP-Link Deco BE25
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device.
This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DB
Deco BE25 v1.0 · TP-Link Systems Inc.
through 1.1.1 Build 20250822 · source: vendor
DB
Deco Be25 Firmware · Tp-link
through 1.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0654
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0654
Product
https://www.tp-link.com/en/support/download/deco-be25/#Firmware
Product
https://www.tp-link.com/sg/support/download/deco-be25/#Firmware
Product
https://www.tp-link.com/us/support/download/deco-be25/v1/#Firmware
Vendor Advisory
https://www.tp-link.com/us/support/faq/4993/
More from Deco BE25 v1.0
8.0
CVE-2026-0655
Path Traversal on TP-Link Deco BE25
7.2
CVE-2026-22229
Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and Deco BE25 v1.0