CVE-2026-5040 | TP-Link Deco M5 v1 uses a weak password hashing mechanism to… | CVSS 7.1 HIGH

Description

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality.

Metadata

CVE ID: CVE-2026-5040
State: PUBLISHED
Assigner: TPLink
Reserved: 2026-03-27 16:26 UTC
Published: 2026-07-14 18:00 UTC
Last updated: 2026-07-14 18:00 UTC
Primary CWE: CWE-916
CWE-916 Use of Password Hash With Insufficient Computational…
Vendor / Product: TP-Link Systems Inc. / Deco M5 Deco M5 V1
Sources: cve.org · NVD

Severity & Metrics

7.1 HIGH CVSS 4.0

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products (1)

Vendor	Product	Platform	Versions
TP-Link Systems Inc.	Deco M5 Deco M5 V1	—	0 < 1.9.4 Build 20260312 Rel.17129

Weakness (CWE)

CWE	Source	Description
CWE-916	cna	CWE-916 Use of Password Hash With Insufficient Computational Effort

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.1	HIGH	4.0	cna	CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)