The vulnerability is a path traversal flaw in TP‑Link Deco BE25 web modules. It permits an authenticated attacker who can reach the router from the local network to read files outside the intended directory or trigger a denial of service. The flaw arises from insufficient path validation, allowing the attacker to exfiltrate sensitive configuration files or crash the device, thereby affecting confidentiality, integrity, and availability.

TP‑Link Systems Inc. Deco BE25 routers running firmware versions 1.0 through 1.1.1 Build 20250822 are impacted. Devices within this firmware range that are exposed to the local network are vulnerable. No fixed release has been announced yet, so later builds are not known to be unaffected.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild. However, the vulnerability requires local network authentication, so it is most likely exploited by device administrators or malicious users that gain local network access. The flaw is not listed in the CISA KEV catalog. Because the attacker can read arbitrary files, the confidentiality impact is significant, and the device may also suffer instability from denial of service attempts.