Deco Be25 Firmware vulnerabilities

2 known vulnerabilities in Deco Be25 Firmware from TP-Link. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.0 High severity

  Deco BE25 v1.0: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-0655Mar 2, 2026TP-Link

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0: t

• 8.0 High severity

  Deco BE25 v1.0: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-0654Mar 2, 2026TP-Link

  Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting conf