CVE-2026-0654Disclosure(tp-link / deco_be25)

LOWCVSS 8.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.

tp-link CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.tp-link.com/us/support/faq/4993/

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

deco_be25
deco_be25_firmware

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-03-02); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

tp-link

Products

deco_be25deco_be25_firmware

1 version affected across 2 products

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-02	3	Disclosure2General1
2026-03-06	1	Disclosure1

Full discourse4 posts

DailyCVE@dailycve216d
Disclosure
🔴 TP-Link Deco BE25, #OS Command Injection, #CVE-2026-0654 (Critical) https://dailycve.com/tp-link-deco-be25-os-command-injection-cve-2026-0654-critical/
Post summary
The tweet announces a new critical OS command injection vulnerability (CVE‑2026‑0654) affecting TP‑Link Deco BE25, but it provides no PoC, exploit code, or patch information.
0000038
164 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds220d
General
CVE-2026-0654 Command Injection Vulnerability in TP-Link Deco BE25 Web Interface https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-0654
Post summary
The text references a command injection vulnerability in the TP‑Link Deco BE25 web interface but offers no further details on exploitation, patches, or active use.
0000047
4.0K followersView on X
Infoflowcloud@infoflowcloud220d
Disclosure
🚨*CVE* CVE-2026-0654 Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated ad… https://www.cve.org/CVERecord?id=CVE-2026-0654 ----- Traducción: CVE-2026-0654 Man… http://infoflow.cloud`
Post summary
The post announces CVE-2026-0654, detailing an OS command injection flaw in TP‑Link Deco BE25 v1.0’s admin interface, without mentioning PoC, exploit code, or patch information.
0000027
55 followersView on X
CVE@CVEnew220d
Disclosure
CVE-2026-0654 Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated ad… https://www.cve.org/CVERecord?id=CVE-2026-0654
Post summary
CVE-2026-0654 is an OS command injection flaw in the TP‑Link Deco BE25 v1.0 admin web interface; the post provides technical details but no PoC, exploit, patch, or evidence of active exploitation.
00000190
56.6K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	tp-link	deco_be25	1.0	-	-
OS	tp-link	deco_be25_firmware	-	-	-

Explore more

Back to dashboard tp-link CVEs deco_be25 vulnerabilities

What researchers are saying

CVE-2026-0654

DailyCVE@dailycveDisclosure

The tweet announces a new critical OS command injection vulnerability (CVE‑2026‑0654) affecting TP‑Link Deco BE25, but it provides no PoC, exploit code, or patch information.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text references a command injection vulnerability in the TP‑Link Deco BE25 web interface but offers no further details on exploitation, patches, or active use.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2026-0654, detailing an OS command injection flaw in TP‑Link Deco BE25 v1.0’s admin interface, without mentioning PoC, exploit code, or patch information.

CVE@CVEnewDisclosure

CVE-2026-0654 is an OS command injection flaw in the TP‑Link Deco BE25 v1.0 admin web interface; the post provides technical details but no PoC, exploit, patch, or evidence of active exploitation.