CVE-2026-0655
Published: 02 March 2026
Summary
CVE-2026-0655 is a high-severity Path Traversal (CWE-22) vulnerability in Tp-Link Deco Be25 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 16.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents path traversal attacks by enforcing validation of pathname inputs in the vulnerable web modules.
Mitigates the vulnerability by identifying and applying vendor-provided firmware updates to remediate the path traversal flaw.
Enforces approved access authorizations to system files and resources, limiting the impact of successful path traversal by authenticated users.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal directly enables arbitrary file read on network device, mapping to local data access and config repository dump.
NVD Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0: through 1.1.1…
more
Build 20250822.
Deeper analysisAI
CVE-2026-0655 is an Improper Limitation of a Pathname to a Restricted Directory vulnerability, classified under CWE-22, affecting the web modules of TP-Link Deco BE25 v1.0. This path traversal issue impacts versions through 1.1.1 Build 20250822 and carries a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for confidentiality, integrity, and availability impacts.
An authenticated adjacent attacker with low privileges can exploit this vulnerability over the adjacent network with low complexity and no user interaction required. Successful exploitation allows the attacker to read arbitrary files on the device or cause a denial of service, potentially compromising sensitive configuration data or disrupting network operations.
TP-Link provides firmware updates for the Deco BE25 v1.0 on regional support download pages, including those for global, Singapore, and US variants, as the primary mitigation. Additional guidance is available in their US support FAQ 4993.
Details
- CWE(s)