CVE-2026-5040

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/en/support/download/deco-m5/v1/#Firmware	Product
https://www.tp-link.com/us/support/download/deco-m5/v1/#Firmware	Product
https://www.tp-link.com/us/support/faq/5190/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tp-link:deco_m5_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:deco_m5:1.0:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) TP-Link Deco M5 v1 utiliza un mecanismo de hash de contraseña débil para almacenar las credenciales de usuario. Un atacante que obtiene el hash de la contraseña mediante compromiso del sistema o acceso privilegiado podría realizar ataques de fuerza bruta o de diccionario. La explotación exitosa puede resultar en la divulgación de credenciales de autenticación, lo que permite el acceso no autorizado a las funciones de gestión del dispositivo, dependiendo de los privilegios asociados con la contraseña recuperada. El principal impacto de seguridad es la pérdida de confidencialidad.

Information

Published : 2026-07-14 19:18

Updated : 2026-10-24 21:10

NVD link : CVE-2026-5040

Mitre link : CVE-2026-5040

CVE.ORG link : CVE-2026-5040

JSON object : View

Products Affected

tp-link

deco_m5_firmware
deco_m5

CWE

CWE-916

Use of Password Hash With Insufficient Computational Effort

{"id": "CVE-2026-5040", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5040", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T04:01:00.675503Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "Deco M5 Deco M5 V1", "versions": [{"status": "affected", "version": "0", "lessThan": "1.9.4 Build 20260312 Rel.17129", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T19:18:03.213", "references": [{"url": "https://www.tp-link.com/en/support/download/deco-m5/v1/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/deco-m5/v1/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5190/", "tags": ["Vendor Advisory"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-916"}]}], "descriptions": [{"lang": "en", "value": "TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks.\n\nSuccessful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality."}, {"lang": "es", "value": "TP-Link Deco M5 v1 utiliza un mecanismo de hash de contrase\u00f1a d\u00e9bil para almacenar las credenciales de usuario. Un atacante que obtiene el hash de la contrase\u00f1a mediante compromiso del sistema o acceso privilegiado podr\u00eda realizar ataques de fuerza bruta o de diccionario.\n\nLa explotaci\u00f3n exitosa puede resultar en la divulgaci\u00f3n de credenciales de autenticaci\u00f3n, lo que permite el acceso no autorizado a las funciones de gesti\u00f3n del dispositivo, dependiendo de los privilegios asociados con la contrase\u00f1a recuperada. El principal impacto de seguridad es la p\u00e9rdida de confidencialidad."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:deco_m5_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B01B5E35-2BC7-406C-A64A-0E6321211FF9", "versionEndExcluding": "1.9.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:deco_m5:1.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "17AD25A2-4196-496E-87BF-B3596F05E9A7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}