CVE-2026-100420 Details
Description
A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
A vulnerability allowing sensitive information disclosure has been identified in the cloud-client daemon of the TP-Link Deco BE63, specifically in hardware version V2.0. This vulnerability allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Exploitation of this vulnerability could lead to unauthorized access to the associated cloud account, allowing attackers to perform actions on behalf of the affected user.
Users are advised to update their devices to the latest firmware version 1.3.3 Build 26071612, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.tp-link.com/us/support/download/deco-be63/v2.60/#Firmware | TPLink | ProductVendor |
| https://www.tp-link.com/us/support/faq/5357/ | TPLink | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-202 | Exposure of Sensitive Information Through Data Queries | TPLink |
Affected Products
| Product | Versions |
|---|---|
| TP-Link Deco BE63 | V2.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | TPLink |