TP-Link Deco BE25, OS Command Injection, CVE-2026-0654 (Critical)

By /

Listen to this Post

CVE-2026-0654 arises from improper input validation within the administrative web interface of the TP-Link Deco BE25 v1.0. Specifically, the web interface fails to sanitize user-supplied input when processing configuration files. An attacker with authenticated access to the adjacent network can upload a specially crafted configuration file containing malicious commands. Due to the lack of input filtering, these commands are concatenated into a system-level OS command string. The underlying firmware then executes this string with elevated privileges, leading to arbitrary command execution on the device. This vulnerability resides in the configuration restoration functionality, where parameters intended for device settings are not correctly handled. By injecting command separators like semicolons or newlines, an attacker can break out of the intended command context and run arbitrary code. The executed commands can read, modify, or delete sensitive data, install backdoors, or leverage the device for further network attacks. The issue affects all firmware versions up to and including 1.1.1 Build 20250822, where the vulnerable code paths remain unpatched. The attack vector is adjacent network access, meaning the attacker must be within the same wireless or wired segment. However, the impact is severe, compromising confidentiality, integrity, and availability completely. Successful exploitation grants full control over the Deco BE25, allowing persistent access and potential lateral movement. TP-Link has acknowledged the vulnerability, and a patch is anticipated in a future firmware release. Until then, users must rely on workarounds like restricting management interface access.

dailycve form:

Platform: TP-Link Deco BE25
Version: 1.1.1 Build 20250822
Vulnerability: OS command injection
Severity: Critical
date: 2026-03-02

Prediction: 2026-04-01

What Undercode Say:

Analytics:

CVE-2026-0654 represents a critical flaw in TP-Link’s consumer mesh system, enabling authenticated adjacent attackers to gain root access. Given the widespread deployment of Deco devices, this vulnerability poses significant risks for home and small office networks. The CVSS score likely approaches 9.0 due to the high impact and low attack complexity. Organizations should prioritize patching once available.

Bash Commands and Codes:

Proof-of-concept exploitation via crafted configuration file:

Create malicious configuration file with command injection
echo 'admin_password=;id > /tmp/pwned;' > deco_config.cfg
Use curl to upload (assumes authenticated session)
curl -X POST -H "Cookie: auth=valid_session" -F "config=@deco_config.cfg" http://192.168.0.1/admin/restore

How Exploit:

  1. Gain authenticated access to the Deco BE25 web interface (default credentials or brute-force).

2. Navigate to the configuration restoration page.

  1. Upload a crafted configuration file containing OS commands injected into parameter values.
  2. The device processes the file, executing injected commands with root privileges.
  3. Attacker achieves remote code execution and full device compromise.

Protection from this CVE:

  • Isolate the management interface from untrusted networks.
  • Change default credentials and use strong passwords.
  • Disable remote administration if not required.
  • Monitor for unauthorized configuration changes.
  • Apply vendor patch as soon as released (predicted 2026-04-01).
  • Implement network segmentation to limit adjacent access.

Impact:

Successful exploitation allows attackers to fully compromise the Deco BE25, leading to data theft, device takeover, and use as a pivot point for further network intrusions. This disrupts network availability, exposes sensitive traffic, and undermines the device’s security posture.

🎯Let’s Practice Exploiting & Learn Patching For Free:

Sources:

Reported By: nvd.nist.gov
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin Previous

Flowise, Authentication Bypass, CVE-2025-58434 (High)

Scroll to Top