{"id":"CVE-2026-100420","kind":"vulnerability","aliases":["CVE-2026-100420"],"related":[],"title":"TP-Link Deco BE63: cloud daemon leaks plaintext TP-Link ID password to logged-in users","description":"A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. \n\nSuccessful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.","summary":"The cloud-client daemon on the TP-Link Deco BE63 mesh router can be made to return the plaintext password of the TP-Link ID cloud account. An attacker who already has an authenticated session on the device can read that password and use it to take over the linked cloud account.","severity":"medium","cvss":6.8,"epss":0.00155,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-account","deco-be63","infrastructure","mesh-router","tp-link"],"not_affected_if":["local-admin-only-access","no-tp-link-id-linked"],"how_to_check":"- Confirm the device model and firmware version in the Deco app or admin page; BE63 is the affected model\n- unknown for the exact vulnerable firmware range, the sources do not list it","fix":"- Update the Deco BE63 to the latest firmware from TP-Link; the sources do not name a fixed version\n- Change the TP-Link ID password and enable two-factor authentication on the account if the device has been shared or exposed\n- Review the TP-Link ID account for unknown logins or devices","status":"open","published_at":"2026-10-21T23:17:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:42:55+00:00","updated_at":"2026-10-25T03:42:55+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:42:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Deco BE63 to the latest firmware from TP-Link; the sources do not name a fixed version\n- Change the TP-Link ID password and enable two-factor authentication on the account if the device has been shared or exposed\n- Review the TP-Link ID account for unknown logins or devices","reach":"network","title":"TP-Link Deco BE63: cloud daemon leaks plaintext TP-Link ID password to logged-in users","impact":"high","summary":"The cloud-client daemon on the TP-Link Deco BE63 mesh router can be made to return the plaintext password of the TP-Link ID cloud account. An attacker who already has an authenticated session on the device can read that password and use it to take over the linked cloud account.","category":"infrastructure","nicknames":[],"who_cares":["tp-link","deco-be63","mesh-router","cloud-account"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads the TP-Link ID password and takes over the cloud account","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-100420 for affected firmware versions and the vendor advisory for a fixed build.","how_to_check":"- Confirm the device model and firmware version in the Deco app or admin page; BE63 is the affected model\n- unknown for the exact vulnerable firmware range, the sources do not list it","needs_analyst":true,"not_affected_if":["no-tp-link-id-linked","local-admin-only-access"],"who_is_affected":"Owners of TP-Link Deco BE63 units that are linked to a TP-Link ID cloud account. The attacker needs an authenticated session on the device, so exposure depends on who can log in to the router, such as family members, guests or contractors with admin access. Users who have not set up the cloud account on this device are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":3368,"output_tokens":680,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-100420':22A,25A '-2026':21A,24A 'account':28B,68B,93B,119C,131C 'action':135C 'affect':140C 'allow':108C,124C 'alreadi':72B 'associ':129C 'attack':70B,110C,125C 'authent':75B,109C 'be63':5A,31B,50B,107C 'behalf':137C 'client':42B,103C 'cloud':6A,27B,41B,67B,92B,102C,130C 'cloud-account':26B 'cloud-client':40B,101C 'compromis':127C 'cve':20A,23A 'daemon':7A,43B,104C 'deco':4A,30B,49B,106C 'deco-be63':29B 'devic':79B 'disclosur':97C 'exploit':122C 'id':13A,66B,118C 'inform':96C 'infrastructur':32B 'leak':8A 'link':3A,12A,38B,48B,65B,91B,117C 'log':17A 'logged-in':16A 'made':55B 'may':123C 'mesh':34B,51B 'mesh-rout':33B 'password':14A,60B,83B,120C 'perform':133C 'plaintext':9A,59B,114C 'read':81B 'retriev':112C 'return':57B 'router':35B,52B 'sensit':95C 'session':76B 'success':121C 'take':88B 'tp':2A,11A,37B,47B,64B,116C 'tp-link':1A,10A,36B,46B,63B,115C 'unauthor':134C 'use':85B 'user':19A,141C 'vulner':98C","nicknames":[],"mitigations":[],"who_affected":"Owners of TP-Link Deco BE63 units that are linked to a TP-Link ID cloud account. The attacker needs an authenticated session on the device, so exposure depends on who can log in to the router, such as family members, guests or contractors with admin access. Users who have not set up the cloud account on this device are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100420","severity":null,"published_at":"2026-10-21T23:17:23+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-100420","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100420","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}