CVE-2026-0654

Name of the Vulnerable Software and Affected Versions TP-Link Deco BE25 versions through 1.1.1 Build 20250822

Description A flaw exists in the administration web interface of the device that allows crafted input to be executed as part of an OS command. An authenticated attacker in a nearby network can potentially execute arbitrary commands through a specially crafted configuration file. This could compromise the confidentiality, integrity, and availability of the device.

Recommendations Update TP-Link Deco BE25 to a version later than 1.1.1 Build 20250822.