CVE-2026-15469 json
Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800
published 2026-08-24 2 mo ago modified 2026-10-12 27 d ago also EUVD-2026-64936
- cvss
- 7.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who obtains the firmware image and has local network access may be able to authenticate as a mesh node without possessing a device-specific credential.
Successful exploitation may allow an unauthenticated adjacent attacker to impersonate a trusted mesh node and bypass mesh node authentication, which may permit unauthorized changes to device or mesh configuration, affecting confidentiality, integrity and availability.
Patch / fix
- TP-Link Systems Inc. Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6 1.5.0 Build 20260603
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- TP-Link Systems Inc. Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6
Classification
- Weakness
-
- CWE-321 Use of Hard-coded Cryptographic Key
References
-
tp-link.com
/us/support/download/deco-xe75/v3.60/#Firmware
patch
-
tp-link.com
/en/support/download/deco-xe75/v3.60/#Firmware
patch
-
tp-link.com
/us/support/download/deco-xe5300/#Firmware
patch
-
tp-link.com
/us/support/download/deco-we10800/#Firmware
patch
-
tp-link.com
/us/support/faq/5263/
vendor-advisory
Sources
- CVE List CVE-2026-15469
- NVD CVE-2026-15469
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.