Description
A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. 

Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
Published: 2026-10-21
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Description A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.  Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
Title Information disclosure vulnerability in the cloud-client daemon of Deco BE63
Weaknesses CWE-202
References
Metrics cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published:

Updated: 2026-10-21T23:04:28.083Z

Reserved: 2026-09-25T20:37:34.701Z

Link: CVE-2026-100420

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T23:17:23.053

Modified: 2026-10-21T23:17:23.053

Link: CVE-2026-100420

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-202

    Exposure of Sensitive Information Through Data Queries