CVE-2026-5040 identifies a vulnerability in TP-Link Systems Inc. Deco M5 V1 where the password hashing mechanism is insufficiently computationally intensive (CWE-916). This weakness enables attackers who obtain password hashes—via system compromise or privileged access—to attempt brute-force or dictionary attacks to recover user credentials. The primary security impact is disclosure of authentication credentials, potentially allowing unauthorized management access depending on the privileges of the compromised account. The CVSS 4.0 vector indicates local attack vector with high attack complexity and required privileges, no user interaction, and high impacts on confidentiality, integrity, and availability.

An attacker with access to the password hashes can perform offline brute-force or dictionary attacks to recover user credentials. If successful, this may lead to unauthorized access to device management functions, compromising confidentiality of the device and potentially its configuration. The vulnerability does not indicate direct remote exploitation or automatic compromise but requires local or privileged access to the hashes.

No official patch or remediation has been published by the vendor as of now. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device and its stored credentials to trusted users only to prevent hash disclosure.