Live › vulnerability › CVE-2026-100420
Go to dashboardThe cloud-client daemon on the TP-Link Deco BE63 mesh router can be made to return the plaintext password of the TP-Link ID cloud account. An attacker who already has an authenticated session on the device can read that password and use it to take over the linked cloud account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners of TP-Link Deco BE63 units that are linked to a TP-Link ID cloud account. The attacker needs an authenticated session on the device, so exposure depends on who can log in to the router, such as family members, guests or contractors with admin access. Users who have not set up the cloud account on this device are unlikely to be exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.
Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
This page as .md · .json · in your agent: get_signal("CVE-2026-100420")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.