CVE-2026-0655: TP-Link Deco BE25 Path Traversal Flaw

CVE-2026-0655 Overview

CVE-2026-0655 is a Path Traversal vulnerability affecting the TP-Link Deco BE25 v1.0 mesh router's web modules. This vulnerability allows an authenticated attacker with adjacent network access to read arbitrary files from the device or cause a denial of service condition. The flaw stems from improper limitation of a pathname to a restricted directory (CWE-22), enabling attackers to traverse outside intended directory boundaries.

Critical Impact

Authenticated attackers on an adjacent network can exploit this vulnerability to access sensitive configuration files, credentials, or other protected data stored on the device, or render the router inoperable through denial of service.

Affected Products

• TP-Link Deco BE25 v1.0 (firmware through 1.1.1 Build 20250822)

Discovery Timeline

• 2026-03-02 - CVE-2026-0655 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-0655

Vulnerability Analysis

This path traversal vulnerability exists within the web modules of the TP-Link Deco BE25 v1.0 mesh router system. The vulnerability occurs when the web interface fails to properly sanitize user-supplied file path inputs, allowing authenticated users to craft requests that traverse beyond the intended web root directory.

When exploited, an attacker can leverage directory traversal sequences (such as ../) to escape the restricted directory structure and access files elsewhere on the device's filesystem. This could expose sensitive system files including configuration data, stored credentials, network topology information, and other protected resources.

The dual impact of this vulnerability—both information disclosure and denial of service—suggests that certain file access patterns may corrupt device state or exhaust system resources, potentially crashing the device or rendering it unresponsive.

Root Cause

The root cause of CVE-2026-0655 is insufficient input validation within the TP-Link Deco BE25 web modules when processing pathname inputs. The application fails to properly sanitize or canonicalize file path parameters before using them in file system operations, allowing directory traversal sequences to be processed rather than rejected.

This represents a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) implementation flaw where user-controlled path components are directly incorporated into filesystem access operations without adequate bounds checking.

Attack Vector

The attack requires adjacent network access and authentication credentials to the device's management interface. An attacker who has gained authenticated access—either through legitimate credentials, credential theft, or exploiting weak default configurations—can craft specially formatted HTTP requests to the web modules.

By injecting directory traversal sequences into file path parameters within these requests, the attacker manipulates the intended file path to point to arbitrary locations on the filesystem. This enables reading of sensitive files beyond the web root directory or triggering denial of service conditions through access to critical system resources.

The attack surface is limited to adjacent networks, meaning the attacker must have local network access (such as being connected to the same mesh network or a directly connected LAN segment) rather than remote internet-based exploitation.

Detection Methods for CVE-2026-0655

Indicators of Compromise

• HTTP requests to the Deco BE25 web interface containing path traversal sequences such as ../, ..%2f, or ..%5c in URL parameters
• Unusual file access patterns in device logs indicating attempts to read system files outside the web root
• Unexpected device reboots or unresponsive behavior potentially indicating DoS exploitation
• Authentication logs showing successful logins followed by suspicious web module activity

Detection Strategies

• Monitor network traffic to TP-Link Deco devices for HTTP requests containing encoded or unencoded directory traversal patterns
• Implement intrusion detection system (IDS) rules to alert on path traversal attempts targeting embedded device web interfaces
• Review device access logs for anomalous authenticated session activity patterns
• Deploy network segmentation to isolate IoT/mesh networking devices and enable better traffic visibility

Monitoring Recommendations

• Enable logging on network security appliances monitoring traffic to and from Deco mesh devices
• Configure alerts for multiple failed or unusual file access attempts from the same authenticated session
• Monitor for unexpected device behavior including crashes, reboots, or configuration changes
• Establish baseline network behavior for Deco devices to identify anomalous traffic patterns

How to Mitigate CVE-2026-0655

Immediate Actions Required

• Update TP-Link Deco BE25 v1.0 firmware to the latest available version from the TP-Link firmware download page
• Review and strengthen authentication credentials for device management interfaces
• Restrict network access to device management interfaces to trusted administrators only
• Segment mesh router management interfaces from untrusted network segments

Patch Information

TP-Link has acknowledged this vulnerability affecting Deco BE25 v1.0 firmware versions through 1.1.1 Build 20250822. Users should download and apply the latest firmware update from the official TP-Link support resources:

• TP-Link Deco BE25 v1 Firmware Downloads
• TP-Link FAQ #4993 for additional guidance

Workarounds

• Restrict administrative access to the Deco BE25 management interface to trusted devices and users only
• Implement network segmentation to limit adjacent network access to the device's management plane
• Use strong, unique authentication credentials and disable any default or weak accounts
• Monitor device logs and network traffic for signs of exploitation attempts until patching is completed

# Network segmentation example - isolate IoT management interfaces
# Configure firewall rules to restrict access to Deco management interface
# Allow only specific trusted administrator IP addresses

# Example iptables rules (apply on network gateway)
iptables -A FORWARD -d 192.168.1.0/24 -p tcp --dport 80 -s 192.168.100.10 -j ACCEPT
iptables -A FORWARD -d 192.168.1.0/24 -p tcp --dport 443 -s 192.168.100.10 -j ACCEPT
iptables -A FORWARD -d 192.168.1.0/24 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.1.0/24 -p tcp --dport 443 -j DROP