CVE-2025-32107

Severity: high (CVSS 8.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-11 · updated 2026-06-17
Weakness: CWE-78

Description

OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123". If this vulnerability is exploited, an arbitrary OS command may be executed by the user who can log in to the device.

Affected products

TP-Link Corporation Limited Deco BE65 Pro: firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123"

References

https://jvn.jp/en/vu/JVNVU94912671/
https://www.tp-link.com/jp/support/download/deco-be65-pro/#Firmware

Get alerted when CVE-2025-32107 or the next vulnerability affects your stack