{"id":"CVE-2026-15469","aliases":["EUVD-2026-64936","GHSA-w7r2-cxjq-9w33"],"status":"published","title":"Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800","description":"The use of\nhard-coded cryptographic key vulnerability has been identified in the mesh\nfunctionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. \nA shared RSA-512 mesh group private key is present in the affected\nfirmware and is used by the mesh protocol for node authentication.  An attacker who obtains the firmware image\nand has local network access may be able to authenticate as a mesh node without\npossessing a device-specific credential.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent attacker to impersonate a\ntrusted mesh node and bypass mesh node authentication, which may permit unauthorized\nchanges to device or mesh configuration, affecting confidentiality, integrity\nand availability.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00414,"percentile":0.36078,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-321"],"published":"2026-08-24T16:32:12Z","modified":"2026-10-12T15:10:00Z","exploits":[{"source":"pocgithub","id":"tony102741/CVE-2026-15469","title":"tony102741/CVE-2026-15469","date":"2026-08-25","url":"https://github.com/tony102741/CVE-2026-15469"}],"products":[{"vendor":"tp-link systems inc.","product":"deco xe75 v3 / xe5300  v3.6/ we10800 v3.6"}],"references":[{"url":"https://www.tp-link.com/us/support/download/deco-xe75/v3.60/#Firmware","tags":["patch"]},{"url":"https://www.tp-link.com/en/support/download/deco-xe75/v3.60/#Firmware","tags":["patch"]},{"url":"https://www.tp-link.com/us/support/download/deco-xe5300/#Firmware","tags":["patch"]},{"url":"https://www.tp-link.com/us/support/download/deco-we10800/#Firmware","tags":["patch"]},{"url":"https://www.tp-link.com/us/support/faq/5263/","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15469"},{"url":"https://www.tp-link.com/us/support/faq/5263"},{"url":"https://github.com/advisories/GHSA-w7r2-cxjq-9w33"}],"sources":{"cve":[{"id":"CVE-2026-15469","title":"Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800","description":"The use of\nhard-coded cryptographic key vulnerability has been identified in the mesh\nfunctionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. \nA shared RSA-512 mesh group private key is present in the affected\nfirmware and is used by the mesh protocol for node authentication.  An attacker who obtains the firmware image\nand has local network access may be able to authenticate as a mesh node without\npossessing a device-specific credential.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent attacker to impersonate a\ntrusted mesh node and bypass mesh node authentication, which may permit unauthorized\nchanges to device or mesh configuration, affecting confidentiality, integrity\nand availability.","status":"published","published":"2026-08-24T16:32:12.573Z","modified":"2026-08-24T18:00:49.583Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high","assessor":"cna"}],"cwes":["CWE-321"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-64936","description":"The use of\nhard-coded cryptographic key vulnerability has been identified in the mesh\nfunctionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. \nA shared RSA-512 mesh group private key is present in the affected\nfirmware and is used by the mesh protocol for node authentication.  An attacker who obtains the firmware image\nand has local network access may be able to authenticate as a mesh node without\npossessing a device-specific credential.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent attacker to impersonate a\ntrusted mesh node and bypass mesh node authentication, which may permit unauthorized\nchanges to device or mesh configuration, affecting confidentiality, integrity\nand availability.","status":"published","published":"2026-08-24T16:32:12Z","modified":"2026-08-24T18:00:49Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high"}],"updated_at":"2026-11-02T18:01:34.563496Z"}],"ghsa":[{"id":"GHSA-w7r2-cxjq-9w33","title":"The use of\nhard-coded cryptographic key vulnerability has been identified in the mesh...","description":"The use of\nhard-coded cryptographic key vulnerability has been identified in the mesh\nfunctionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. \nA shared RSA-512 mesh group private key is present in the affected\nfirmware and is used by the mesh protocol for node authentication.  An attacker who obtains the firmware image\nand has local network access may be able to authenticate as a mesh node without\npossessing a device-specific credential.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent attacker to impersonate a\ntrusted mesh node and bypass mesh node authentication, which may permit unauthorized\nchanges to device or mesh configuration, affecting confidentiality, integrity\nand availability.","status":"published","published":"2026-08-24T18:31:51Z","modified":"2026-08-24T18:31:58Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-321"],"updated_at":"2026-11-02T15:10:54.092672Z"}],"nvd":[{"id":"CVE-2026-15469","description":"The use of\nhard-coded cryptographic key vulnerability has been identified in the mesh\nfunctionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. \nA shared RSA-512 mesh group private key is present in the affected\nfirmware and is used by the mesh protocol for node authentication.  An attacker who obtains the firmware image\nand has local network access may be able to authenticate as a mesh node without\npossessing a device-specific credential.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent attacker to impersonate a\ntrusted mesh node and bypass mesh node authentication, which may permit unauthorized\nchanges to device or mesh configuration, affecting confidentiality, integrity\nand availability.","status":"published","published":"2026-08-24T17:17:21.587Z","modified":"2026-10-12T15:10:00.207Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-321"],"updated_at":"2026-11-02T14:12:41.018848Z"}]}}