Medium severity · published Oct 21, 2026
CVE-2026-100420
Information disclosure vulnerability in the cloud-client daemon of Deco BE63
New
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.
Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DB
Deco BE63 V2.0 · TP-Link Systems Inc.
before 1.3.3 Build 26071612 · source: vendor