Hard-coded RSA-512 Mesh Key in TP-Link Deco Routers

TP-Link Deco XE75, XE5300, and WE10800 mesh networking devices contain a hard-coded RSA-512 cryptographic key used for mesh group authentication (TDP/TMP protocols). Because this key is identical across all units of the affected models, an attacker with local network access to the mesh environment can extract the key from publicly available firmware images. Using this key, an attacker can impersonate a legitimate mesh node during the authentication handshake. This vulnerability, tracked as CVE-2026-15469, facilitates critical risks including unauthorized configuration changes, the deployment of unsigned malicious firmware, and seamless lateral movement across the mesh network. The flaw was publicly disclosed following vendor coordination and a patch release. It is fixed in firmware version 1.5.0 Build 20260603 and later.

Impact

Successful exploitation allows for the complete compromise of the mesh network environment. Attackers can gain control over configuration settings, inject malicious firmware updates to maintain persistence, and pivot through the network as a trusted mesh node. This affects all deployments of the listed TP-Link Deco models that have not been updated to the corrected firmware version.

Recommendation

• Update all TP-Link Deco XE75, XE5300, and WE10800 units to firmware version 1.5.0 Build 20260603 or newer immediately.
• Audit mesh network traffic for unauthorized node onboarding or unusual administrative activity originated from unexpected MAC addresses.
• Restrict physical and logical access to the management and mesh-interconnect network segments to prevent adjacent network attackers from reaching the mesh protocol interfaces.