TP-Link Deco BE25 Path Traversal Vulnerability Allowing Arbitrary File Read or Denial-of-Service

A path traversal vulnerability has been identified in the TP-Link Deco BE25 v1.0 web modules, allowing authenticated adjacent attackers to read arbitrary files or cause a denial-of-service. This vulnerability arises from improper limitations on pathnames, enabling exploitation by traversing directories to access restricted files.

Impact

Exploitation of this vulnerability could lead to unauthorized reading of files or causing a denial-of-service condition on the device.

Remediation

Users are advised to update to the latest firmware version. The updated firmware can be downloaded from the TP-Link official website for the respective region.