CVE-2026-100420: Information disclosure vulnerability in the cloud-client daemon of Deco BE63
Published Oct 21, 2026
·Updated
A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.
Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
Affected Software
1 affected component
TP-Link Deco BE63
Event History
Oct 21, 2026
CVE Published
via MITRE·11:04 PM
Data Sourced
via MITRE·11:04 PM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need?
The attacker must be authenticated to exploit the vulnerability.
2
What information can be obtained through exploitation?
An authenticated attacker may retrieve the TP-Link ID account password in plaintext.
3
What could an attacker do with the disclosed password?
The attacker may be able to compromise the associated cloud account and perform unauthorized actions as the affected user.