TP-Link Deco BE25 Command Injection Vulnerability
Vulnerability
A command injection vulnerability has been identified in the TP-Link Deco BE25 v1.0 administration web interface. This vulnerability allows authenticated adjacent attackers to execute arbitrary OS commands by injecting crafted input through a configuration file. The issue affects versions through 1.1.1 Build 20250822.
Impact
Exploitation of this vulnerability allows for arbitrary command execution on the affected device.
Remediation
Users are advised to update to the latest firmware version. The updated firmware can be downloaded from the TP-Link official website, selecting the appropriate regional site.
Added: Mar 2, 2026, 6:32 PM
Updated: Mar 2, 2026, 9:11 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
7.5exploitability
3.5remediation
0.0relevance
3.4threat
0.0urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.