TP-Link Deco CVE-2026-15469

Exploitation requires two concrete preconditions: (1) the attacker must obtain the shared RSA-512 private key, achievable either by downloading and unpacking the publicly available firmware image from TP-Link's support portal, or potentially by factoring the RSA-512 modulus from observed public-key material in mesh traffic; and (2) the attacker must have adjacent network access to the mesh network - i.e., be on the same local network segment as at least one mesh node, whether via a wired connection, the same Wi-Fi SSID, or a guest network that is not fully isolated. Exploitation is limited by network adjacency: internet-facing or remote exploitation is not possible given AV:A. No authentication to an existing mesh node or management interface is required for the attack itself (PR:N). Devices must be running firmware earlier than 1.5.0 Build 20260603.

The CVSS 4.0 score of 7.7 (AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L) reflects a credible but adjacent-only threat: exploitation is bounded to the local network segment, and AT:P acknowledges the precondition of firmware acquisition. However, the precondition is weak - TP-Link's own download pages (referenced in this CVE) make the firmware freely available to anyone with internet access, so AT:P should not be read as a meaningful barrier. RSA-512's factorability further reduces the effective key secrecy even if firmware were not public. No KEV listing and no public POC exist at time of analysis, so this is not confirmed as actively exploited. The primary limiting factor is network adjacency: an attacker must be on the same local network segment as the mesh nodes, preventing mass internet-scale exploitation. For home and SMB environments where the Deco mesh is co-located with untrusted devices or guest Wi-Fi, the risk is materially higher. EPSS data is not available in the provided input and cannot be assessed.

An attacker on the same local network downloads the affected firmware image directly from TP-Link's public support portal, unpacks it to extract the embedded RSA-512 private key, and then uses that key to authenticate to the target mesh network as a trusted node. Once accepted as a legitimate mesh peer, the attacker can push unauthorized configuration changes to the mesh group - including modifying routing, DNS settings, or access controls - affecting confidentiality, integrity, and availability of the network. No device-specific credential or prior account access is required.