CVE-2026-0654

CVE-2026-0654 describes an OS command injection in the TP-Link Deco BE25 v1.0 administration web interface. The root cause is improper input handling that allows crafted input via a configuration file to be executed, enabling an authenticated adjacent attacker to run arbitrary commands. Affected ...

CVE-2026-0655

CVE-2026-0655 affects TP-Link Deco BE25 v1.0 (web modules) up to firmware 1.1.1 Build 20250822. The issue is a path traversal vulnerability that allows an authenticated adjacent attacker to read arbitrary files or cause a denial of service. Connected sources confirm the vulnerable product/version...