TP-Link Deco Hard-coded Mesh Private Key Vulnerability (CVE-2026-15469)

Vulnerability Overview Vulnerability Name: Hard-coded Mesh Group Private Key in Deco XE75, XE5300, and WE10800 CVE ID: CVE-2026-15469 CVSS v4.0 Score: 7.7 / High Description: This vulnerability involves a hard-coded Mesh group private key in Deco XE75, XE5300, and WE10800 devices. An attacker who obtains the firmware image and has local network access may be able to authenticate as a Mesh node without possessing device-specific credentials. Successful exploitation could allow an unauthenticated adjacent attacker to impersonate a trusted Mesh node and bypass Mesh node authentication, potentially enabling unauthorized changes to the device or Mesh configuration, thereby impacting confidentiality, integrity, and availability. Affected Products Affected Products: - Deco XE75: Hardware Version V3 - Deco XE5300: Hardware Version V3.6 - Deco WE10800: Hardware Version V3.6 Remediation Recommended Actions: 1. Update affected devices to the latest firmware version that patches this vulnerability: - EN: Download for Deco XE75 - US: Download for Deco XE75 - Download for Deco XE5300 - Download for Deco WE10800 Additional Information Disclaimer: This advisory is for reference only and may be subject to change without notice. TP-Link recommends that customers promptly apply the available firmware updates provided in this advisory or implement documented workarounds. Devices/systems that are not updated or mitigated as described may still be vulnerable. TP-Link assumes no responsibility or liability for any damages or losses resulting from the failure to implement such updates. Related Links Related FAQs: - How to Configure Port Security Function - Kasa Smart Camera Questions on Setup, Recording, Security, and More - WPA2 Security (KRACKs) Vulnerability Statement Looking For More: - Making Hotel WiFi Secure and Easy to Use - What Is Home Network Security and How Do I Secure My WiFi Router? Community Support TP-Link Community: For assistance, visit the TP-Link Community to search for answers, ask questions, or get help from TP-Link experts and other users. Subscription and Contact Subscribe: Enter your email address to subscribe to exclusive offers and news. Social Media: Links provided for Facebook, Instagram, YouTube, LinkedIn, and X. Footer Information About: Includes links to About Us, Corporate Information, Contact Us, Sustainability, Privacy Policy, Your Privacy Choices, Careers at TP-Link, Accessibility, and Our Security Commitment. News: Includes links to News, Blog, Security Advisories, Security News, Awards, etc. Partners: Includes links to Partner Program, Partner Registration, MAP Policy, etc. Learning Center: Includes links to Technology Trends, Training, and Certifications, etc. Promotions: Provides promotional information. Copyright Information Copyright: ©2026 TP-Link Systems Inc. and its affiliated companies. All rights reserved. Brands: Brand identifiers for TP-Link, Kasa, Tapo, Omada, VIGI, etc. Language: English version available.

Goal Reached Thanks to every supporter — we hit 100%!

TP-Link Deco Hard-coded Mesh Private Key Vulnerability (CVE-2026-15469)

More from this source