CVE-2026-100420: Deco BE63 V2.0 0 to before 1.3.3 Build 26071612

Affected technology

Deco BE63 V2.0 · 0 to before 1.3.3 Build 26071612
TP-Link Systems Inc.

Component: cloud-client

Attack conditions (Source advisory, CVSS 4.0): Adjacent network · High privileges required · No user interaction required

What an attacker can do

Authenticated attackers can retrieve the plaintext TP-Link ID account password. Source advisory’s CVSS 4.0 assessment (base score 6.8/10) rates confidentiality impact as high; integrity and availability impact as none.