A vulnerability in the cloud‑client daemon of TP‑Link Deco BE63 allows an authenticated attacker to obtain the plaintext TP‑Link ID account password. The disclosure of this credential can enable the attacker to compromise the associated cloud account and execute unauthorized actions on behalf of the user, representing a significant threat to account integrity and confidentiality. The weakness is classified as CWE‑202 and is an information disclosure issue that impacts the confidentiality of the cloud account.

The affected product is TP‑Link Systems Inc.’s Deco BE63 modem/router running firmware version 2.0. The vendor’s references indicate that newer firmware (e.g., 2.60) addresses the flaw, implying that devices with older firmwares are vulnerable.

The CVSS score of 6.8 positions the vulnerability in the medium severity range. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is not currently widespread. Exploitation requires valid authentication to the cloud‑client daemon, but once the plaintext password is obtained the attacker can potentially take full control of the cloud account. In the absence of active exploitation evidence, the overall risk is moderate and mitigated by applying the vendor’s firmware update.