What’s Vulnerable › Vulnerabilities

CVE-2026-5040: Weak Password Hashing Mechanism in TP-Link Deco M5

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-916

Description

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality.

Affected products

• TP-Link Systems Inc. Deco M5 Deco M5 V1: before 1.9.4 — fixed in 1.9.4

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. Deco M5 Deco M5 V1 1.9.4. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/deco-m5/v1/#Firmware
• https://www.tp-link.com/us/support/download/deco-m5/v1/#Firmware
• https://www.tp-link.com/us/support/faq/5190/

Get alerted when CVE-2026-5040 or the next vulnerability affects your stack