CVE-2026-15469
Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800
Description
The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who obtains the firmware image and has local network access may be able to authenticate as a mesh node without possessing a device-specific credential. Successful exploitation may allow an unauthenticated adjacent attacker to impersonate a trusted mesh node and bypass mesh node authentication, which may permit unauthorized changes to device or mesh configuration, affecting confidentiality, integrity and availability.
INFO
Published Date :
Aug. 24, 2026, 5:17 p.m.
Last Modified :
Oct. 12, 2026, 3:10 p.m.
Remotely Exploit :
No
Source :
f23511db-6c3e-4e32-a477-6aa17d310630
Affected Products
The following products are affected by CVE-2026-15469
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | f23511db-6c3e-4e32-a477-6aa17d310630 | ||||
| CVSS 4.0 | HIGH | f23511db-6c3e-4e32-a477-6aa17d310630 |
Solution
- Update Deco XE75, XE5300, and WE10800 firmware.
- Verify mesh node authentication.
- Remove hard-coded keys from firmware.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-15469.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-15469 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-15469
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-15469 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-15469 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6 de TP-Link Systems Inc., Description: Se ha identificado el uso de una vulnerabilidad de clave criptográfica codificada de forma rígida en la funcionalidad de malla de Deco XE75 v3, XE5300 v3.6 y WE10800 v3.6. Una clave privada de grupo de malla RSA-512 compartida está presente en el firmware afectado y es utilizada por el protocolo de malla para la autenticación de nodos. Un atacante que obtiene la imagen del firmware y tiene acceso a la red local podría autenticarse como un nodo de malla sin poseer una credencial específica del dispositivo. La explotación exitosa podría permitir a un atacante adyacente no autenticado suplantar a un nodo de malla de confianza y eludir la autenticación de nodos de malla, lo que podría permitir cambios no autorizados en la configuración del dispositivo o de la malla, afectando la confidencialidad, integridad y disponibilidad. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 24, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-15469', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-24T17:25:18.245788Z'} -
New CVE Received by f23511db-6c3e-4e32-a477-6aa17d310630
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'TP-Link Systems Inc.', 'modules': ['mesh'], 'product': 'Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.5.0 Build 20260603', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}] Added Description The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who obtains the firmware image and has local network access may be able to authenticate as a mesh node without possessing a device-specific credential. Successful exploitation may allow an unauthenticated adjacent attacker to impersonate a trusted mesh node and bypass mesh node authentication, which may permit unauthorized changes to device or mesh configuration, affecting confidentiality, integrity and availability. Added CVSS V4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-321 Added Reference https://www.tp-link.com/en/support/download/deco-xe75/v3.60/#Firmware Added Reference https://www.tp-link.com/us/support/download/deco-we10800/#Firmware Added Reference https://www.tp-link.com/us/support/download/deco-xe5300/#Firmware Added Reference https://www.tp-link.com/us/support/download/deco-xe75/v3.60/#Firmware Added Reference https://www.tp-link.com/us/support/faq/5263/