Skip to content
OpenAdvisories
High · 7.7 Public exploit CVE-2026-15469 EUVD-2026-64936GHSA-w7r2-cxjq-9w33

Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800

Published Aug 24, 2026 · Updated Aug 24, 2026 · Assigned by TPLink

Vendor: TP-Link Systems Product: Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6 Category: Network devices

Description

The use of
hard-coded cryptographic key vulnerability has been identified in the mesh
functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. 
A shared RSA-512 mesh group private key is present in the affected
firmware and is used by the mesh protocol for node authentication.  An attacker who obtains the firmware image
and has local network access may be able to authenticate as a mesh node without
possessing a device-specific credential.

Successful
exploitation may allow an unauthenticated adjacent attacker to impersonate a
trusted mesh node and bypass mesh node authentication, which may permit unauthorized
changes to device or mesh configuration, affecting confidentiality, integrity
and availability.

Affected products

VendorProductAffectedFixed
TP-Link Systems Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6 < 1.5.0 Build 20260603 1.5.0 Build 20260603

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • tony102741/CVE-2026-15469 ★ 2 · Aug 25, 2026

    CVE-2026-15469 — Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75/XE5300/WE10800 (CWE-321). Advisory, analysis & PoC methodology (EN/KO).

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References