Deco Be63 V2 0
Monthly
Information disclosure in TP-Link Deco BE63 v2.0 lets an attacker who already holds administrative privileges on the device, and can reach it from an adjacent LAN or Wi-Fi segment, query the cloud-client daemon and recover the linked TP-Link ID account password in plaintext. That credential could then be used to access the associated TP-Link cloud account and perform actions as the affected user. The vendor has released a firmware update, and no public exploit was identified at time of analysis; the independent assessment rates this as a constrained medium-severity risk because exploitation requires admin access and adjacent-network positioning.
Information disclosure in TP-Link Deco BE63 v2.0 lets an attacker who already holds administrative privileges on the device, and can reach it from an adjacent LAN or Wi-Fi segment, query the cloud-client daemon and recover the linked TP-Link ID account password in plaintext. That credential could then be used to access the associated TP-Link cloud account and perform actions as the affected user. The vendor has released a firmware update, and no public exploit was identified at time of analysis; the independent assessment rates this as a constrained medium-severity risk because exploitation requires admin access and adjacent-network positioning.