Deco Xe75 V3 Xe5300 V3 6 We10800 V3 6
Monthly
Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75 v3, XE5300 v3.6, and WE10800 v3.6 firmware allows an adjacent attacker to impersonate a trusted mesh node without possessing any device-specific credential. Because the same private key is shared across all affected devices and embedded in firmware images that TP-Link publishes publicly on its download portal, the barrier to key extraction is low. No public exploit or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75 v3, XE5300 v3.6, and WE10800 v3.6 firmware allows an adjacent attacker to impersonate a trusted mesh node without possessing any device-specific credential. Because the same private key is shared across all affected devices and embedded in firmware images that TP-Link publishes publicly on its download portal, the barrier to key extraction is low. No public exploit or active exploitation has been identified at time of analysis, but a vendor-released patch is available.