CVE-2026-5040

Name of the Vulnerable Software and Affected Versions TP-Link Deco M5 version v1

Description The device uses a weak password hashing mechanism to store user credentials. An attacker with privileged access or who has compromised the system could obtain the password hash and perform dictionary or brute-force attacks. This could lead to the disclosure of authentication credentials and unauthorized access to device management functions, resulting in a loss of confidentiality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.