---

📋 At a glance

🎯 Affected products

Affected module: mesh. Originally analyzed on ver1.3.1 Build 20251023 rel.43624.

🔍 Root cause

The Deco mesh protocol authenticates AP ↔ RE (satellite) nodes with an RSA group key stored in the group-info partition (fw_data/user_data/group-info, UBI partition 27). The complete RSA-512 key — including the private components d, p, and q — is embedded in the firmware image, and the same key and static group ID ship in every unit of every affected model.

Because the key is private, identical across all devices, and extractable offline from a firmware image anyone can download, an attacker never needs a device-specific credential. Possessing the key alone satisfies the mesh authentication gate (sync_slave_check in discover.lua).

The transport reaching that gate provides no additional secret:

• tmpsvr listens on UDP 20002 (TDP) and TCP 20002 (TMP).
• The TDP integrity field is a plain CRC32 (a constant is substituted before the checksum is computed), so any modified packet is trivially re-checksummed — no secret is involved.
• The opcode_whitelist filter is absent from the default /etc/config/firewall, so all opcodes are dispatched without filtering.

💥 Impact

Once authentication passes with the extracted key, sensitive operations are reachable with no secondary authentication:

Net result: an unauthenticated, LAN-adjacent attacker can impersonate a trusted mesh node, overwrite device and mesh configuration, flash arbitrary firmware, and compromise every node in the mesh — without physical access.

⛓️ Attack chain

1. Extract the RSA-512 private key offline from a publicly downloadable firmware image.
2. Forge a TDP packet — the CRC32 is recomputable, so no secret key is needed.
3. Bypass sync_slave_check by RSA-decrypting the group challenge with the extracted key.
4. Execute a config overwrite (uci_apply), an unsigned firmware flash (SYNC_FIRMWARE + SYNC_UPGRADE), or a mesh-wide pivot (forward_tmp_request).
5. Compromise every satellite node in a single operation.

Full protocol and call-chain analysis is in docs/technical-analysis.md; reproduction methodology is in docs/poc-methodology.md.

🛡️ Remediation

• Update to 1.5.0 Build 20260603 or later from the official TP-Link download pages (below).
• The patched firmware adds an authentication layer (tmpv2 v2.0): the control channel moves behind Dropbear SSH on port 20001 with an ASSOC handshake and per-session UUID tokens, and tmpsvr binds to 127.0.0.1 only. Static validation of the fix is in docs/patch-validation.md.
• Until updated, restrict untrusted access to the LAN/mesh segment and to UDP/TCP port 20002.

🗓️ Disclosure timeline

🔗 References

• CVE record — https://www.cve.org/CVERecord?id=CVE-2026-15469
• TP-Link advisory (FAQ 5263) — https://www.tp-link.com/us/support/faq/5263/
• Firmware — Deco XE75 · Deco XE5300 · Deco WE10800
• CWE-321 — https://cwe.mitre.org/data/definitions/321.html

⚠️ Responsible disclosure

This repository is published after vendor coordination and the release of a fix. The actual hard-coded RSA-512 private key material and the static group ID are redacted throughout (shown as [REDACTED …]) to prevent direct exploitation of devices that have not yet been updated. The documents describe the vulnerability structure, root cause, and reproduction methodology for defensive and educational purposes; they do not provide turn-key exploit key material.

📂 Documents

📄 License

Documentation and analysis are licensed under CC BY 4.0 · © 2026 Junsung Ahn