CVE-2026-100420 - Vulnerability Details - OpenCVE

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Tp-link	Deco Be63

No data.

No data.

References

Link	Providers
https://www.tp-link.com/us/support/download/deco-be63/v2.60/#Firmware
https://www.tp-link.com/us/support/faq/5357/

History

Thu, 22 Oct 2026 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tp-link Tp-link deco Be63
Vendors & Products		Tp-link Tp-link deco Be63

Wed, 21 Oct 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
Title		Information disclosure vulnerability in the cloud-client daemon of Deco BE63
Weaknesses		CWE-202
References		https://www.tp-link.com/us/support/download/deco-be63/v2.60/#Firmware https://www.tp-link.com/us/support/faq/5357/
Metrics		cvssV4_0 `{'score': 6.8, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: TPLink

Published: 2026-10-21T23:04:28.083Z

Updated: 2026-10-21T23:04:28.083Z

Reserved: 2026-09-25T20:37:34.701Z

Link: CVE-2026-100420

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-10-21T23:17:23.053

Modified: 2026-10-22T15:31:24.813

Link: CVE-2026-100420

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100420", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-09-25T20:37:34.701Z", "datePublished": "2026-10-21T23:04:28.083Z", "dateUpdated": "2026-10-21T23:04:28.083Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-10-21T23:04:28.083Z"}, "title": "Information disclosure vulnerability in the cloud-client daemon of Deco BE63", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-202", "description": "CWE-202 Exposure of sensitive information through data queries", "type": "CWE"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Deco BE63 V2.0", "modules": ["cloud-client"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.3 Build 26071612", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.\u00a0\n\nSuccessful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>A sensitive information disclosure vulnerability in the <code>cloud-client</code> daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. </div><div>Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.</div>"}]}], "references": [{"url": "https://www.tp-link.com/us/support/download/deco-be63/v2.60/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5357/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["cloud-client"], "product": "Deco BE63 V2.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.3.3 Build 26071612", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.\u00a0\n\nSuccessful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user."}], "id": "CVE-2026-100420", "lastModified": "2026-10-22T15:31:24.813", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}, "published": "2026-10-21T23:17:23.053", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/download/deco-be63/v2.60/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/faq/5357/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-202"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}