Deco BE63 CVE-2026-100420

Exploitation requires the attacker to already hold high/administrative privileges on the Deco BE63 device (PR:H) and to reach it from an adjacent network such as the local LAN or Wi-Fi segment (AV:A) - it is not remotely exploitable from the internet and not exploitable by an unauthenticated user. The specific prerequisite is the ability to query the device's cloud-client daemon, which is the component that stores the TP-Link ID account password in plaintext; the account must have been linked to a TP-Link cloud ID for a credential to exist for disclosure. Limiting factors: administrative authentication, adjacent-network positioning, and the device being bound to a cloud account. No user interaction is required (UI:N).

This is a genuine but constrained risk, best characterized as medium severity rather than a top-tier priority. The input CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N/VC:H) scores 6.8 and is internally consistent with the description: adjacent-network reach plus high privileges (an already-authenticated administrator) yields high confidentiality impact (plaintext credential disclosure) with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The chief limiting signal is PR:H combined with AV:A - an attacker must already hold administrative access to the device and be on the adjacent network, which sharply narrows the realistic threat population and argues against widespread opportunistic exploitation. The real danger is credential reuse and pivot: the leaked TP-Link ID password is a reusable secret that extends access from a single compromised device to the victim's entire cloud account. No signals conflict; the vendor-supplied vector, the description, and CWE-202 (exposure of sensitive information through data queries) all align.

An attacker who already has administrative access to a Deco BE63 (for example via shared/default credentials, a prior compromise, or a malicious insider on the local network) queries the cloud-client daemon and reads the stored TP-Link ID password in plaintext. With that reusable credential the attacker logs into the victim's TP-Link cloud account to control devices and perform actions as the user. No public exploit is identified at time of analysis, and the adjacent-network plus admin-privilege requirement limits this to attackers already positioned on or near the device.