Sensitive Information Disclosure in Deco BE63 Cloud Client Daemon by TP-Link
CVE-2026-100420

6.8MEDIUM

Key Information:

Vendor

Tp-link Systems Inc.

Status
Deco Be63 V2.0
Vendor
CVE Published:
21 October 2026

What is CVE-2026-100420?

The Deco BE63 features a vulnerability within its cloud-client daemon that allows authenticated attackers to access sensitive information, specifically the plaintext TP-Link ID account password. This flaw could enable malicious entities to exploit the associated cloud account, potentially leading to unauthorized actions on behalf of the affected user. It is critical for users to be aware of this risk and consider updating their firmware to mitigate exposure.

Affected Version(s)

Deco BE63 V2.0 0 < 1.3.3 Build 26071612

References

https://www.tp-link.com/us/support/download/deco-be63/v2....
patch
https://www.tp-link.com/us/support/faq/5357/
vendor-advisory

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.