CVE-2026-0654highCWE-78

CVE-2026-0654: high-severity vulnerability in TP-Link Systems Inc. Deco BE25 v1.0

Command injection on TP-Link Deco BE25

Published · Updated

Follow this CVE+ Monitor Deco BE25

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.3%
Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected products
TP-Link Systems Inc. · Deco BE25 v1.0
Related CVEs — TP-Link Systems Inc. Deco BE25 v1.0

In the same product, most dangerous first.

CVE-2026-22229HIGHCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and Deco BE25 v1.0EPSS 2.1%CVE-2026-0655MEDIUMPath Traversal on TP-Link Deco BE25EPSS 0.3%