What is the CVSS score of CVE-2026-0654?

CVE-2026-0654 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Deco Be25 Firmware are affected by CVE-2026-0654?

A high-severity command injection vulnerability in TP-Link Deco BE25 mesh routers allows attackers to execute arbitrary operating system commands through the administration interface.

How to fix or mitigate CVE-2026-0654?

Within 24 hours: Inventory all TP-Link Deco BE25 v1.0 devices in your network and restrict administrative access to trusted networks only. Within 7 days: Implement network segmentation to isolate affected devices and disable remote administration features if not operationally critical. Within 30 days: Develop a device replacement plan or establish a vendor timeline for patch availability; evaluate alternative mesh networking solutions if patch delivery is delayed beyond 60 days.

Deco Be25 Firmware CVE-2026-0654

HIGH

OS Command Injection (CWE-78)

2026-03-02 f23511db-6c3e-4e32-a477-6aa17d310630

TP-Link Command Injection Deco Be25 Firmware

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 18:16 nvd

HIGH 8.0

DescriptionCVE.org

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.

AnalysisAI

Arbitrary command execution in TP-Link Deco BE25 firmware v1.0 through v1.1.1 Build 20250822 stems from improper input validation in the web administration interface, allowing authenticated adjacent attackers to inject OS commands via malicious configuration files. Successful exploitation grants full control over the affected device with complete compromise of confidentiality, integrity, and availability. No patch is currently available.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects the administration web component of Deco Be25 Firmware. Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.