CVE-2026-0654
Last modified
CVE-2026-0654 is a high-severity vulnerability rated 8/10 on the CVSS scale. Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.
Metrics
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tp-Link | Deco Be25 Firmware | <= 1.1.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-0654?
How severe is CVE-2026-0654?
How do I fix CVE-2026-0654?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-0648The vulnerability stems from an incorrect error-checking log…6.3
- CVE-2026-0649A security vulnerability has been detected in invoiceninja u…4.7
- CVE-2026-0650OpenFlagr versions prior to and including 1.1.18 contain an …9.3
- CVE-2026-0651A path traversal vulnerability was identified TP-Link Tapo C…7.8
- CVE-2026-0652On TP-Link Tapo C260 v1, command injection vulnerability exi…8.8
- CVE-2026-0653On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authentic…6.5
- CVE-2026-0655Improper Limitation of a Pathname to a Restricted Directory …8
- CVE-2026-0656The iPaymu Payment Gateway for WooCommerce plugin for WordPr…8.2
- CVE-2026-0658The Five Star Restaurant Reservations WordPress plugin befo…4.3
- CVE-2026-0659A maliciously crafted USD file, when loaded or imported into…7.8
- CVE-2026-0660A maliciously crafted GIF file, when parsed through Autodesk…8.4
- CVE-2026-0661A maliciously crafted RGB file, when parsed through Autodesk…8.4
Are you affected by CVE-2026-0654?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST