Improper validation of input supplied to the Deco BE25 v1.0 administration web interface allows crafted data to be forwarded to the operating system shell. The result is that an attacker who can authenticate to an adjacent device can inject and execute arbitrary commands, giving the attacker full control over the device. This compromises confidentiality, integrity, and availability of the router and any network traffic it handles.

The vulnerability affects TP‑Link Systems Inc. Deco BE25 model v1.0 through 1.1.1 Build 20250822. Devices running any firmware within this range are susceptible.

The CVSS score of 8.5 indicates high severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. The likely attack vector is a local, authenticated attacker on the same network who can upload a crafted configuration file to the device.