CVE-2026-0654: TP-Link Deco BE25 RCE Vulnerability

CVE-2026-0654 Overview

CVE-2026-0654 is a command injection vulnerability affecting the TP-Link Deco BE25 v1.0 mesh router system. The vulnerability stems from improper input handling in the device's administration web interface, which allows crafted input to be executed as part of an operating system command. An authenticated attacker with adjacent network access can exploit this flaw by uploading a specially crafted configuration file, potentially gaining full control over the affected device.

Critical Impact

Authenticated attackers on the local network can achieve arbitrary command execution on affected TP-Link Deco BE25 devices, compromising the confidentiality, integrity, and availability of the network infrastructure.

Affected Products

• TP-Link Deco BE25 v1.0 (firmware through 1.1.1 Build 20250822)

Discovery Timeline

• 2026-03-02 - CVE-2026-0654 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-0654

Vulnerability Analysis

This vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). The administration web interface of the TP-Link Deco BE25 v1.0 fails to properly sanitize user-supplied input before incorporating it into system commands. When an authenticated administrator uploads or modifies configuration files through the web interface, malicious input embedded within these files can escape the intended context and execute arbitrary OS commands on the underlying embedded Linux system.

The attack requires the adversary to be on an adjacent network (such as the local LAN or mesh network) and possess valid administrative credentials. However, once these prerequisites are met, the attacker can achieve complete system compromise, including persistent backdoor installation, traffic interception, or using the device as a pivot point for further network attacks.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization within the configuration file parsing routines of the Deco BE25's web administration interface. The firmware fails to properly escape or validate special characters and command sequences before passing configuration data to shell commands or system calls. This allows metacharacters such as semicolons, backticks, or pipe operators to break out of the intended data context and inject arbitrary commands into the execution flow.

Attack Vector

The attack vector requires adjacent network access, meaning the attacker must be connected to the same local network segment as the target device. The attacker needs authenticated administrative access to the Deco BE25's web interface, which could be obtained through credential theft, default credentials, or social engineering. Once authenticated, the attacker crafts a malicious configuration file containing embedded OS commands and uploads it through the administrative interface. The vulnerable parsing logic then executes the injected commands with the privileges of the web service, typically running as root on embedded devices.

The attack scenario involves uploading configuration data that contains shell metacharacters. When the device processes this configuration, the embedded commands are executed on the device's operating system. For example, malicious payloads could be injected into configuration fields that are later processed by shell scripts or system utilities, allowing the attacker to spawn reverse shells, modify firewall rules, or exfiltrate sensitive data.

Detection Methods for CVE-2026-0654

Indicators of Compromise

• Unexpected processes running on the Deco BE25 device, such as reverse shells or network tools not part of standard firmware
• Unusual outbound network connections from the router to external IP addresses
• Modified configuration files containing suspicious command sequences or shell metacharacters
• Unexpected administrative login attempts or sessions from unauthorized network locations

Detection Strategies

• Monitor administrative access logs for unusual login patterns or configuration changes
• Implement network segmentation to isolate IoT and network infrastructure devices
• Use network monitoring tools to detect anomalous traffic patterns originating from router devices
• Deploy intrusion detection systems (IDS) capable of identifying command injection patterns in HTTP traffic

Monitoring Recommendations

• Enable and regularly review administrative access logs on the Deco BE25 management interface
• Monitor for firmware integrity changes using file integrity monitoring where supported
• Set up alerts for configuration file modifications outside of normal maintenance windows
• Implement network traffic analysis to detect unusual command and control communications from network devices

How to Mitigate CVE-2026-0654

Immediate Actions Required

• Update TP-Link Deco BE25 v1.0 firmware to a patched version as soon as one becomes available
• Change default administrative credentials to strong, unique passwords
• Restrict administrative interface access to trusted network segments only
• Disable remote management features if not required for operations

Patch Information

TP-Link has published firmware updates addressing this vulnerability. Administrators should download and apply the latest firmware version from the official TP-Link Deco BE25 v1 Firmware page. Additional security guidance is available in the TP-Link FAQ #4993.

Affected firmware versions include builds through 1.1.1 Build 20250822. Organizations should verify their current firmware version through the device's web interface and update immediately if running a vulnerable build.

Workarounds

• Limit administrative access to the web interface to only trusted administrators with verified need
• Implement network access controls (VLANs, firewall rules) to restrict who can reach the administrative interface
• Monitor configuration changes and administrative sessions for suspicious activity until patching is complete
• Consider temporarily disabling web-based administration if alternate management methods are available

# Network segmentation example - restrict admin interface access
# Example iptables rules on upstream firewall to limit access to Deco admin interface
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 443 -s 192.168.1.100 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 443 -j DROP