TP-Link Deco M5 Weak Password Hashing Vulnerability Allowing Credential Disclosure

A vulnerability exists in the TP-Link Deco M5 v1 due to the use of a weak password hashing method for storing user credentials. This flaw allows an attacker who gains access to the password hash, either through system compromise or privileged access, to execute brute-force or dictionary attacks. Successful exploitation could lead to the unauthorized disclosure of authentication credentials, granting access to device management functions based on the privileges associated with the recovered password.

Impact

Exploitation of this vulnerability could result in unauthorized access to device management functions, depending on the privileges linked to the recovered password. This access could allow an attacker to manipulate device settings or functionalities.

Remediation

Users are advised to update their devices to the latest firmware version 1.9.4 Build 20260312, which addresses this vulnerability.