CVE-2026-100420
Last modified
CVE-2026-100420 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | Deco BE63 V2.0 | < 1.3.3 Build 26071612 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-100420?
How severe is CVE-2026-100420?
How do I fix CVE-2026-100420?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-10041The WCFM – Frontend Manager for WooCommerce plugin for WordP…4.3
- CVE-2026-100413SeaweedFS is a distributed storage system for files and blob…7.1
- CVE-2026-100417RustDesk before 1.5.0 on Windows fails to enforce the one-wa…3.1
- CVE-2026-100418Flame through 2.4.0 contains an information exposure vulnera…5.3
- CVE-2026-100419gitoxide gix-fs before 0.23.0 contains a path validation byp…7
- CVE-2026-10042manga-image-translator contains a remote code execution vuln…9.8
- CVE-2026-10043MosaicML Composer Deserialization of Untrusted Data Remote C…7.8
- CVE-2026-10044Usagi-org ai-goofish-monitor contains an unauthenticated arb…8.2
- CVE-2026-10045Shenzhen Kangda Xin Intelligent Network Technology Company's…9.8
- CVE-2026-10046Bitdefender Napoca bare-metal hypervisor contains an out-of-…7.8
- CVE-2026-10047The Bitdefender Napoca bare-metal hypervisor contains an out…7.8
- CVE-2026-100493An integer overflow in the DDS RGB888 loader of AMD Compress…6.9
Are you affected by CVE-2026-100420?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST