TP-Link Deco M5 CVE-2026-5040

Exploitation requires the attacker to already possess the stored password hash, which per the description is only obtainable 'through system compromise or privileged access' to the Deco M5 v1 - consistent with the CVSS AV:L and PR:H metrics. The exact prerequisite is read access to the location where credentials are hashed and stored (device filesystem/NVRAM or a configuration backup). Limiting factors that reduce realistic risk: this is not remotely reachable (local vector), it demands high existing privileges, AC:H reflects the non-trivial cracking effort, no user interaction is involved (UI:N), and the weakness is scoped to the Deco M5 v1 hardware revision. A strong, high-entropy password materially blunts the offline-cracking step even where the hash is exposed.

This is a meaningful but conditional weakness, not a top-tier emergency. The vendor-supplied CVSS 4.0 vector rates it 7.1 (High) but its metrics tell the real story: AV:L and PR:H mean the attacker must already have local access and high privileges (or an existing system compromise) to obtain the hash before this flaw provides any value, and AC:H reflects the additional work of cracking. There is no EPSS score in the provided data, no POC, and no KEV listing, so there is no evidence of active or automatable exploitation - the SSVC-style read is 'not automatable, requires prior access.' Note two data conflicts to verify: (1) the input's Tags label this 'Authentication Bypass,' but the description and CWE-916 describe credential-hash weakness enabling offline cracking, not a direct bypass - the tag appears inaccurate; and (2) the vendor 4.0 vector claims full VC:H/VI:H/VA:H impact, yet the description explicitly states 'The primary security impact is loss of confidentiality,' suggesting integrity/availability impact is overstated. Treat this as a defense-in-depth hardening issue that raises the cost of an already-privileged compromise rather than a standalone remotely exploitable vulnerability.

An attacker who has already gained privileged or local access to a Deco M5 v1 unit - for example via a separate firmware flaw, a stolen configuration backup, or physical/administrative access - extracts the stored credential hash from the device. Because the hash uses a weak, fast algorithm, the attacker cracks it offline with a wordlist or GPU brute-force and recovers the plaintext admin password, then reuses it to log into the device management interface and any accounts that share the password. No public POC is identified, and the high attack complexity and local vector make this a follow-on step in a larger intrusion rather than an initial-access technique.