Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Deco BE63 V2.0 | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 21 Oct 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user. | |
| Title | Information disclosure vulnerability in the cloud-client daemon of Deco BE63 | |
| Weaknesses | CWE-202 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: TPLink
Published:
Updated: 2026-10-21T23:04:28.083Z
Reserved: 2026-09-25T20:37:34.701Z
Link: CVE-2026-100420
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-21T23:17:23.053
Modified: 2026-10-21T23:17:23.053
Link: CVE-2026-100420
Redhat
No data.
OpenCVE Enrichment
No data.