QwikSec

Security Database

CVE

CWE

Training

CVE-2026-0654

Published: Mar 2, 2026

Modified: Mar 11, 2026

PUBLISHED

Description

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.

Vendor	Product	Versions
TP-Link Systems Inc.	Deco BE25 v1.0	affected `0 - <= 1.1.1 Build 20250822`

Weaknesses (CWE)

References

https://www.tp-link.com/sg/support/download/deco-be25/#Firmware

patch

https://www.tp-link.com/en/support/download/deco-be25/#Firmware

patch

https://www.tp-link.com/us/support/download/deco-be25/v1/#Firmware

patch

https://www.tp-link.com/us/support/faq/4993/

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.