CVE-2026-0655Disclosure(tp-link / deco_be25)

LOWCVSS 8.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.

tp-link CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.tp-link.com/us/support/faq/4993/

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

deco_be25
deco_be25_firmware

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-03-02); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

tp-link

Products

deco_be25deco_be25_firmware

1 version affected across 2 products

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-02	3	Disclosure2General1
2026-03-06	1	Disclosure1

Full discourse4 posts

DailyCVE@dailycve215d
Disclosure
🟠 TP-Link Deco BE25, Path Traversal, #CVE-2026-0655 (Medium) https://dailycve.com/tp-link-deco-be25-path-traversal-cve-2026-0655-medium/
Post summary
A new medium‑severity path traversal vulnerability (CVE‑2026‑0655) has been disclosed for the TP‑Link Deco BE25 router, with no evidence of exploitation, PoC, or patch information in the provided text.
0000055
164 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds219d
Disclosure
CVE-2026-0655 Path Traversal in TP-Link Deco BE25 Web Modules Enables Arbitrary File Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-0655
Post summary
A path traversal vulnerability (CVE-2026-0655) in TP‑Link Deco BE25 Web Modules allows arbitrary file access; no PoC, exploit, patch, or active exploitation details are provided.
0000056
4.0K followersView on X
Infoflowcloud@infoflowcloud219d
Disclosure
🚨*CVE* CVE-2026-0655 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attac… https://www.cve.org/CVERecord?id=CVE-2026-0655 ----- Traducción: CVE-2026-0655 Lim… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-0655, a path traversal flaw in TP‑Link Deco BE25 v1.0, and links to the official CVE record.
0000033
55 followersView on X
CVE@CVEnew220d
General
CVE-2026-0655 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attac… https://www.cve.org/CVERecord?id=CVE-2026-0655
Post summary
The text references CVE‑2026‑0655, describing a path traversal flaw in TP‑Link Deco BE25 v1.0 web modules, but provides no evidence of PoC, exploit, active use, or patch information.
00000244
56.6K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	tp-link	deco_be25	1.0	-	-
OS	tp-link	deco_be25_firmware	-	-	-

Explore more

Back to dashboard tp-link CVEs deco_be25 vulnerabilities

What researchers are saying

CVE-2026-0655

DailyCVE@dailycveDisclosure

A new medium‑severity path traversal vulnerability (CVE‑2026‑0655) has been disclosed for the TP‑Link Deco BE25 router, with no evidence of exploitation, PoC, or patch information in the provided text.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A path traversal vulnerability (CVE-2026-0655) in TP‑Link Deco BE25 Web Modules allows arbitrary file access; no PoC, exploit, patch, or active exploitation details are provided.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE-2026-0655, a path traversal flaw in TP‑Link Deco BE25 v1.0, and links to the official CVE record.

CVE@CVEnewGeneral

The text references CVE‑2026‑0655, describing a path traversal flaw in TP‑Link Deco BE25 v1.0 web modules, but provides no evidence of PoC, exploit, active use, or patch information.