CVE-2026-5040 describes a vulnerability in TP-Link Deco M5 v1 where the password hashing mechanism is insufficiently computationally intensive (CWE-916). This weakness allows an attacker who obtains password hashes via system compromise or privileged access to attempt brute-force or dictionary attacks more effectively. The vulnerability primarily impacts confidentiality by potentially exposing authentication credentials, which could enable unauthorized management access depending on the privileges of the recovered credentials.

The vulnerability can lead to disclosure of authentication credentials if an attacker obtains the password hashes. This may allow unauthorized access to device management functions, compromising the confidentiality of the device and potentially its configuration and network security. The severity is rated high with a CVSS 4.0 score of 7.1, reflecting the difficulty of exploitation (local access with high attack complexity and privileges required) but significant impact if successful.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, limit privileged access to the device to trusted administrators only to reduce the risk of hash disclosure.