{"cve":"CVE-2026-15469","nvd":{"published":"2026-08-24T17:17:21.587","modified":"2026-10-12T15:10:00.207","status":"Awaiting Analysis","description":"The use of\nhard-coded cryptographic key vulnerability has been identified in the mesh\nfunctionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. \nA shared RSA-512 mesh group private key is present in the affected\nfirmware and is used by the mesh protocol for node authentication.  An attacker who obtains the firmware image\nand has local network access may be able to authenticate as a mesh node without\npossessing a device-specific credential.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent attacker to impersonate a\ntrusted mesh node and bypass mesh node authentication, which may permit unauthorized\nchanges to device or mesh configuration, affecting confidentiality, integrity\nand availability.","cvss_v4":{"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","score":7.7},"cvss_v3":null,"cwes":["CWE-321"],"references":["https://www.tp-link.com/en/support/download/deco-xe75/v3.60/#Firmware","https://www.tp-link.com/us/support/download/deco-we10800/#Firmware","https://www.tp-link.com/us/support/download/deco-xe5300/#Firmware","https://www.tp-link.com/us/support/download/deco-xe75/v3.60/#Firmware","https://www.tp-link.com/us/support/faq/5263/"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:50:17.453294893+00:00"},"epss":{"cve":"CVE-2026-15469","score":0.00414,"percentile":0.35449,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}