CVE-2026-0654
Published: 02 March 2026
Summary
CVE-2026-0654 is a high-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Deco Be25 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses improper input handling in the administration web interface by requiring validation of all inputs, including crafted configuration files, to prevent command injection.
Mandates timely flaw remediation through firmware updates that patch the command injection vulnerability in TP-Link Deco BE25.
Restricts the types and quantities of inputs to the web interface, limiting the ability to upload crafted configuration files that enable OS command execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection (CWE-78) in admin web interface directly enables exploitation of the public/adjacent-facing application (T1190) resulting in Unix shell command execution (T1059.004).
NVD Description
Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity…
more
and availability of the device. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.
Deeper analysisAI
CVE-2026-0654 involves improper input handling in the administration web interface of the TP-Link Deco BE25 v1.0, enabling crafted input to be executed as part of an OS command through a crafted configuration file. This command injection vulnerability, classified under CWE-78, affects Deco BE25 v1.0 versions through 1.1.1 Build 20250822.
An authenticated adjacent attacker can exploit this vulnerability to execute arbitrary commands on the device. According to the CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires physical adjacency, low complexity, and low privileges (local authentication), but grants high impacts on confidentiality, integrity, and availability.
TP-Link provides firmware updates as the primary mitigation, available via support download pages for the Deco BE25, including regional variants at https://www.tp-link.com/en/support/download/deco-be25/#Firmware, https://www.tp-link.com/sg/support/download/deco-be25/#Firmware, https://www.tp-link.com/us/support/download/deco-be25/v1/#Firmware, and additional guidance in FAQ 4993 at https://www.tp-link.com/us/support/faq/4993/.
Details
- CWE(s)