Which versions of TP-Link Deco M5 are affected by EUVD-2026-44362?

TP-Link Deco M5 v1 mesh routers contain a credential disclosure vulnerability enabling attackers who gain access to password hashes to recover plaintext credentials via offline brute-force attacks,…. A patch is available.

How to fix or mitigate EUVD-2026-44362?

Within 24 hours, inventory all Deco M5 v1 devices and restrict both local and remote access to affected units through physical security and firewall rules. Within 7 days, implement network segmentation to isolate router management interfaces and limit administrative access to trusted networks and administrative staff. Within 30 days, monitor TP-Link security advisories for firmware updates addressing the weak hashing scheme; once available, test and deploy patched firmware across all Deco M5 v1 devices, or if no patch emerges by end of 30 days, evaluate replacement with routers employing cryptographically strong credential storage.

TP-Link Deco M5 EUVD-2026-44362

Q: What is the CVSS score of EUVD-2026-44362?

EUVD-2026-44362 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-5040 HIGH

Use of Password Hash With Insufficient Computational Effort (CWE-916)

2026-07-14 TPLink

GHSA-6vqq-hcvj-cx94

Authentication Bypass TP-Link Deco M5 Deco M5 V1 Tp Link Systems Inc

7.1

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.1 MEDIUM

Attacker needs local, high-privilege access to obtain the hash (AV:L/PR:H), offline cracking adds effort (AC:H), and impact is confidentiality-only per the description (C:H, I:N, A:N).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 14, 2026 - 23:20 EUVD

Analysis Generated

Jul 14, 2026 - 20:08 vuln.today

CVE Published

Jul 14, 2026 - 18:00 cve.org

HIGH 7.1

DescriptionCVE.org

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks.

Successful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality.

AnalysisAI

Credential disclosure in TP-Link Deco M5 v1 mesh routers stems from a weak (computationally cheap) password-hashing scheme used to store local user credentials, letting an attacker who has already obtained the stored hash recover the plaintext password via offline brute-force or dictionary attacks. Affected devices are the Deco M5 v1 hardware revision, and successful cracking yields access to device management functions scoped to the recovered account's privileges. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 vector (AV:L/AC:H/PR:H) reflects that it is a post-compromise credential-recovery weakness rather than a remote entry point.

Technical ContextAI

The root cause is CWE-916 (Use of Password Hash With Insufficient Computational Effort): credentials are stored with a fast or unsalted hashing primitive rather than a deliberately slow, salted key-derivation function (e.g., bcrypt, scrypt, Argon2, or high-iteration PBKDF2). On embedded consumer networking gear like the Deco M5 mesh system, such hashes typically live in NVRAM or a config/backup blob on the device filesystem. Because the hash can be computed cheaply, an attacker with a copy of it can test billions of candidate passwords offline. The single affected component per CPE is cpe:2.3:a:tp-link_systems_inc.:deco_m5_deco_m5_v1, i.e., the first hardware/firmware generation of the Deco M5 whole-home mesh Wi-Fi product.

RemediationAI

Patch available per vendor advisory: apply the latest Deco M5 v1 firmware from TP-Link's download portal (https://www.tp-link.com/us/support/download/deco-m5/v1/#Firmware or the EN mirror), noting that the provided data does not confirm an exact first-fixed firmware version - verify the fixed build directly with TP-Link before relying on it. Because exploitation requires an attacker to first obtain the stored hash through device compromise or privileged access, the most effective compensating controls target that precondition: set a long, high-entropy admin/Wi-Fi password so that even a cheaply computed hash resists dictionary attacks; disable remote/cloud management and any WAN-side administration so the management plane is not reachable from the internet (trade-off: loss of remote app management convenience); segment the router's management interface onto a trusted VLAN/subnet and restrict local network access to it; and rotate all device credentials after any suspected compromise since old hashes remain crackable. Review the vendor FAQ at https://www.tp-link.com/us/support/faq/5190/ for model-specific hardening steps.