Sploitus

Exploit for CVE-2026-15469

githubexploit Β· 2026-08-25

Exploit Code

README55 lines
## https://sploitus.com/exploit?id=3D953520-C13A-55AE-B146-8184DA3EA47F
# CVE-2026-15469 β€” Hard-coded Mesh Group Private Key in TP-Link Deco XE75 / XE5300 / WE10800

> πŸ‡¬πŸ‡§ English (this file) Β· πŸ‡°πŸ‡· [ν•œκ΅­μ–΄](README.ko.md)

[![CVE](https://img.shields.io/badge/CVE-2026--15469-red)](https://vulners.com/cve/CVE-2026-15469)
[![CWE](https://img.shields.io/badge/CWE-321-orange)](https://cwe.mitre.org/data/definitions/321.html)
[![CVSS 4.0](https://img.shields.io/badge/CVSS%204.0-7.7%20HIGH-critical)](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
[![Status](https://img.shields.io/badge/status-Fixed%20by%20vendor-brightgreen)](https://www.tp-link.com/us/support/faq/5263/)

A shared **RSA-512 mesh group private key** is hard-coded into the TP-Link Deco XE75 / XE5300 / WE10800 firmware image and is identical across every unit of the affected models. The mesh protocol (TDP/TMP) uses this key for node authentication, so an attacker who extracts it from any publicly downloadable firmware image and has local (LAN-adjacent) network access can **impersonate a trusted mesh node and bypass mesh node authentication** β€” leading to unauthorized configuration changes, unsigned firmware flashing, and lateral movement across every node in the mesh.

This vulnerability was reported to TP-Link and is **fixed** in firmware `1.5.0 Build 20260603` and later.

---

## Summary

| | |
|---|---|
| **CVE ID** | [CVE-2026-15469](https://vulners.com/cve/CVE-2026-15469) |
| **Title** | Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800 |
| **Weakness** | [CWE-321: Use of Hard-coded Cryptographic Key](https://cwe.mitre.org/data/definitions/321.html) |
| **Attack pattern** | [CAPEC-115: Authentication Bypass](https://capec.mitre.org/data/definitions/115.html) |
| **Severity** | **7.7 (HIGH)** β€” CVSS 4.0 |
| **Vector** | `CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L` |
| **CNA / Assigner** | TP-Link Systems Inc. |
| **Published** | 2026-08-24 |
| **Fixed in** | `1.5.0 Build 20260603` (see vendor advisory) |
| **Credit** | Junsung Ahn (finder) |

## Affected products

| Product | Version | Fixed version |
|---|---|---|
| TP-Link Deco XE75 v3 | `
- TP-Link security advisory (FAQ 5263) β€” 
- Deco XE75 firmware β€” 
- Deco XE5300 firmware β€” 
- Deco WE10800 firmware β€” 
- CWE-321 β€” 

## Responsible disclosure note

This repository is published **after** vendor coordination and the release of a fix. The actual hard-coded RSA-512 private key material and the static group ID are **redacted** throughout this repository (shown as `[REDACTED …]`) to prevent direct exploitation of devices that have not yet been updated. The documents describe the vulnerability structure, root cause, and reproduction methodology for defensive and educational purposes; they do not provide turn-key exploit key material.

## License

Documentation and analysis in this repository are licensed under [CC BY 4.0](LICENSE).

## Documents

- [Technical analysis](docs/technical-analysis.md) Β· [기술 뢄석](docs/technical-analysis.ko.md)
- [PoC methodology](docs/poc-methodology.md) Β· [PoC 방법둠](docs/poc-methodology.ko.md)
- [Patch validation](docs/patch-validation.md) Β· [패치 검증](docs/patch-validation.ko.md)