{"id":"CVE-2026-100420","published":"2026-10-21T23:17:23.053","lastModified":"2026-10-22T15:31:24.813","description":"A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. \n\nSuccessful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-202"],"vendors":[],"products":[],"references":[{"url":"https://www.tp-link.com/us/support/download/deco-be63/v2.60/#Firmware","tags":[]},{"url":"https://www.tp-link.com/us/support/faq/5357/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}