← Back to CVEs

CVE-2026-0655

HIGH

8.0

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.

CVE Details

CVSS v3.1 Score8.0

SeverityHIGH

CVSS VectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorADJACENT_NETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published3/2/2026

Last Modified3/6/2026

Sourcenvd

Honeypot Sightings0

Affected Products

tp-link:deco_be25tp-link:deco_be25_firmware

Weaknesses (CWE)

CWE-22

References

https://www.tp-link.com/en/support/download/deco-be25/#Firmware(f23511db-6c3e-4e32-a477-6aa17d310630)

https://www.tp-link.com/sg/support/download/deco-be25/#Firmware(f23511db-6c3e-4e32-a477-6aa17d310630)

https://www.tp-link.com/us/support/download/deco-be25/v1/#Firmware(f23511db-6c3e-4e32-a477-6aa17d310630)

https://www.tp-link.com/us/support/faq/4993/(f23511db-6c3e-4e32-a477-6aa17d310630)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.