CVE-2026-100420— Information disclosure vulnerability in the cloud-client daemon of Deco BE63
Quick assessment
Affected
TP-Link Systems Inc. Deco BE63 V2.0
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
TP-Link Deco BE63 的云客户端守护进程（cloud-client daemon）中存在敏感信息泄露漏洞，允许已认证的攻击者获取 TP-Link ID 账户密码的明文。成功利用该漏洞后，攻击者可能接管关联的云账户，并代表受影响用户执行未经授权的操作。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100420
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information disclosure vulnerability in the cloud-client daemon of Deco BE63
Source: CVE Program / CVE List V5
Vulnerability Description
A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.
Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过数据查询的敏感数据暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TP-Link Systems Inc. | Deco BE63 V2.0 | 0 ~ 1.3.3 Build 26071612 | - |
|
II. Public POCs for CVE-2026-100420
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100420
请登录查看更多情报信息。
Vendor Pages for CVE-2026-100420 (2)
IV. Related Vulnerabilities
Same vendor: TP-Link Systems Inc.
-
CVE-2026-89052
Hardcoded AES encryption key in Archer C6 -
CVE-2026-105815
Credential Material Exposure Leading to Unauthorized Streame -
CVE-2026-105814
Order-Dependent Authentication Bypass in the DS JSON API in -
CVE-2026-105810
Authenticated Local Stack Overflow in TP-Link Tapo C320WS -
CVE-2026-107795
Improper Authorization in TP-Link Omada Controller TLS Certi
Same weakness: CWE-202
-
CVE-2026-79633
Apache Answer: Missing Authorization Allows Mutations of Non -
CVE-2026-79620
Apache Answer: Improper Authorization Allows Disclosure of N -
CVE-2026-79613
Apache Answer: Disclosure of Comments on Non-Public Content -
CVE-2026-106506
Backstage: Improper input validation in scaffolder task list -
CVE-2026-103440
pagetriagelist discloses suppressed reviewer usernames
V. Comments for CVE-2026-100420
No comments yet