Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 2, 2026 · NIST NVD

   Detected

   Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.

2. Jun 17, 2026 · NIST NVD

   Updated

   Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.

Affected

• cpe tp-link/deco be25 firmwareversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-0654

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-0654

  Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integr

  nvd.nist.gov

References

• Product · tp-link.com
• Product · tp-link.com
• Product · tp-link.com
• Vendor Advisory · tp-link.com