All vulnerabilities
CVE-2026-100420

Information disclosure vulnerability in the cloud-client daemon of Deco BE63

TP-Link Systems Inc. Deco BE63 V2.0Network & edge
Open in ThreatlineRecord JSON
CVSS
6.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.3.3 Build 26071612Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1.3.3 Build 26071612Deco BE63 V2.0CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.

Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.

Text from CVE List

Affected versions 1

  • Deco BE63 V2.0affected: all versions before 1.3.3 Build 26071612CVE List

References 2