What is the CVSS score of CVE-2026-0655?

CVE-2026-0655 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Deco Be25 Firmware are affected by CVE-2026-0655?

A path traversal vulnerability in TP-Link Deco BE25 WiFi mesh systems (v1.0-1.1.1) allows authenticated attackers on the network to read sensitive files or disrupt service availability.

How to fix or mitigate CVE-2026-0655?

Within 24 hours: Inventory all TP-Link Deco BE25 devices in production and verify installed firmware versions (1.0 through 1.1.1 Build 20250822 are affected). Within 7 days: Isolate affected devices to a restricted management network segment and disable remote administration features; restrict access to the web interface to trusted administrative IPs only. Within 30 days: Contact TP-Link support for patch availability; evaluate replacement with alternative mesh systems if patch timeline exceeds organizational risk tolerance.

Deco Be25 Firmware CVE-2026-0655

HIGH

Path Traversal (CWE-22)

2026-03-02 f23511db-6c3e-4e32-a477-6aa17d310630

TP-Link Denial Of Service Path Traversal Deco Be25 Firmware

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 18:16 nvd

HIGH 8.0

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.

AnalysisAI

TP-Link Deco BE25 firmware versions 1.0 through 1.1.1 (Build 20250822) contain a path traversal vulnerability that allows authenticated adjacent network attackers to read arbitrary files or trigger denial of service without user interaction. The vulnerability affects the web module component and requires local network access with valid credentials to exploit. No patch is currently available for this high-severity flaw (CVSS 8.0).

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Deco Be25 Firmware. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.