Hard-Coded Cryptographic Key Vulnerability in Deco Mesh Products by TP-Link
CVE-2026-15469

7.7HIGH

Key Information:

Vendor: Tp-link Systems Inc.
Status: Deco Xe75 V3 / Xe5300 V3.6/ We10800 V3.6
Vendor: CVE Published:; 24 August 2026

🔔 Create Tp-link Systems Inc. Vulnerability Alert

What is CVE-2026-15469?

A vulnerability has been identified in the mesh functionality of TP-Link's Deco XE75, XE5300, and WE10800 products, where a shared RSA-512 mesh group private key is hard-coded into the firmware. This key is utilized for node authentication within the mesh protocol. An attacker with local network access who acquires the firmware image could impersonate a legitimate mesh node without needing device-specific credentials. Exploiting this vulnerability may allow unauthorized modifications to device or mesh configurations, posing risks to the confidentiality, integrity, and availability of the network.