Is CVE-2026-100420 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100420 being exploited in the wild.

How severe is CVE-2026-100420?

Informational severity, published 21 October 2026.

Is there a fix for CVE-2026-100420?

Yes: fixed in 1.3.3 Build 26071612. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100420 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-100420?

Check whether you run TP-Link Deco BE63 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100420: TP-Link Deco BE63 plaintext password disclosure in cloud-client daemon

CVE-2026-100420 · Severity: info · Published 2026-10-21

TP-Link Deco BE63 is a mesh Wi-Fi system that connects to TP-Link's cloud service for remote management. An authenticated attacker can retrieve the plaintext TP-Link account password stored by the cloud-client daemon, allowing them to take over the user's cloud account and perform unauthorized actions such as reconfiguring the network or accessing connected devices.

Vendors: TP-Link.

Quick answers

Is CVE-2026-100420 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100420 being exploited in the wild.
How severe is CVE-2026-100420?: Informational severity, published 21 October 2026.
Which products and versions are affected?: TP-Link Deco BE63 V2.0.
Is there a fix for CVE-2026-100420?: Yes: fixed in 1.3.3 Build 26071612. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100420 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-100420?: Check whether you run TP-Link Deco BE63 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.3.3 Build 26071612

Technical details

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 V2.0 allows authenticated attackers with high privilege to retrieve plaintext TP-Link ID account credentials without user interaction. This credential theft enables unauthorized access to the victim's cloud account and associated services. The vulnerability is fixed in firmware version 1.3.3 Build 26071612.

Affected products

TP-Link Deco BE63 V2.0

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.