Researchers say a debug service on the Deco XE75 Pro V3 allows users with valid local administrator credentials to read and write arbitrary root-owned files, including persistent storage and web content.
Security researchers have disclosed an owner-authenticated flaw in the TP-Link Deco XE75 Pro V3 that, if exploited by someone with valid administrator credentials on the local network, can be used to write arbitrary files as root through a debug channel exposed on TCP port 20001. The disclosure says the device accepts an SSH session tied to the owner account, forwards that session to an internal service on 127.0.0.1:20002, and then accepts a file-push command that opens caller-supplied paths in write mode without an allowlist, size limit or privilege drop. A companion read primitive is also present, giving authenticated access to root-level file reading as well as writing.
The report places the issue on firmware 1.5.0 Build 20260603 Rel.15804 and argues that the weakness remains in code paths that should have been hardened after earlier academic and conference work on Deco mesh routers. Researchers from the University of California, Riverside had already described the same debug SSH-to-tmpsvr architecture in 2024, and the new disclosure says several root-level handlers are still available in the June 2026 firmware. According to the report, the device’s SSH host key has been increased from the 512-bit key discussed in the earlier research to a 2048-bit RSA key, but that change did not remove the underlying debug surface.
The practical effect is broader than a single configuration file. The disclosure says the writable targets include a live ramfs used for device configuration, the web content tree served over HTTPS, and a persistent flash-backed data area that survives reboot. In the reported test on the owner’s own hardware, the researchers say they were able to place a harmless marker file, read it back through the root-read primitive and confirm that the router served the file unchanged over HTTPS before reverting the change. They also note that a separate Lua-related path could, in principle, be used to reach root command execution, although that route was not presented as the primary proof of exploitation.
The new disclosure also sits alongside a wider set of TP-Link Deco security reports published in late August 2026 under CVE-2026-15469, which multiple advisories describe as a local-network authentication issue involving a shared or hard-coded RSA-512 mesh group private key on Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6 devices. Those advisories focus on attackers impersonating mesh nodes to alter configuration and affect confidentiality, integrity and availability. The fresh report differs in emphasis: it describes a separate, owner-authenticated debug path that yields root file read and write access rather than a mesh-authentication bypass alone.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
