| TP-Link Deco X60
|
|
Security Grade
Calculator v1
|
TP-Link Deco X60 (AX5400 Whole Home Mesh Wi-Fi 6 System)
Release Date: 2020-01-05 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
A physical reset button on the unit creates a local reset surface; no exposed user-serviceable storage. Rare is an exposure judgment.
|
| Known vulnerabilities
|
Rare
|
[1] 🔗 Proof
|
No CVE names Deco X60 specifically; cited CVEs are platform-level TP-Link Deco/Archer command-injection and hardcoded-key issues, fixed in later firmware.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Home routers face ongoing internet scanning, but no named mass-exploitation campaign identifies the Deco X60 platform as a victim.
|
| Updatability
|
Very common
|
🔗 Proof
|
The Deco platform uses OTA firmware upgrades delivered through the app, with ongoing builds published on the support/download page.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Remote management relies on a TP-Link ID cloud account; Wi-Fi clients authenticate with WPA2/WPA3 pre-shared keys rather than mutual cryptographic device-to-device auth.
|
| Communications
|
No encryption
|
🔗 Proof
|
Wi-Fi clients use WPA2/WPA3 and app/cloud management uses HTTPS, but the spec sheet also lists an always-on local web server on HTTP port 80 in the default service set.
|
| Storage
|
No encryption
|
🔗 Proof
|
Configuration and firmware live on internal flash; the vendor documents no disk/flash encryption feature for user settings.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Management is centered on a single TP-Link ID bound to the home network; the model does not expose rich local multi-user/role administration.
|
| Authentication
|
Basic
|
🔗 Proof
|
Remote/app access is password-based TP-Link ID sign-in; no mandatory second factor is documented for the assessed profile.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
HomeShield provides network-level threat protection, but no documented local account lockout / failed-login threshold is published for the admin login.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The app reports connected devices and monthly usage/security summaries, but no detailed administrative login audit trail is documented.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
There is no shared default admin password; initial setup creates a TP-Link ID and sets the Wi-Fi password during onboarding. No published enforced complexity policy is cited.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Deco mesh firmware (vendor OTA); assessment: current supported build per official download page (Companion App: TP-Link Deco app (Android/iOS); optional local web UI (HTTP/HTTPS))
|
| Hardware (CPU / GPU)
|
CPU: Qualcomm 1 GHz quad-core CPU • GPU:
|
| Memory & Storage
|
Memory: Not officially disclosed by TP-Link on the public datasheet • Storage: Internal flash (vendor not publishing capacity); no user-expandable storage
|
| Power, Battery & Charging
|
Battery: • Power: 12 V DC via AC adapter; adapter input 100–240 V~ 50/60 Hz; 16 W max (EU) • Charging:
|
| Display & Camera
|
Display: Status LEDs • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: 2× Gigabit Ethernet per unit (WAN/LAN auto-sensing); dual-band Wi-Fi 6 (2.4 GHz 574 Mbps + 5 GHz 4804 Mbps); WPA/WPA2/WPA3-Personal
|
| Physical (Dimensions & Mass)
|
Dimensions: 110 × 110 × 114 mm (W × D × H, per unit) • Mass:
|
Documentation-based security assessment: TP-Link Deco X60 (AX5400 Whole Home Mesh Wi-Fi 6 System). Reviewed 2026-10-24.
2
3
Documentation-based assessment of a defined Deco X60 profile managed through the Deco app bound to a TP-Link ID cloud account. Initial onboarding creates the account and sets the Wi-Fi password; there is no shared default admin credential. Wireless clients use WPA2/WPA3-Personal. Remote/app management reaches the device over the vendor cloud; the local web service is reachable on both HTTP port 80 and HTTPS 443 in the documented default service set. Firmware updates are delivered as automatic OTA builds published on the support/download page. The physical reset button on the unit is retained. Internal flash holds configuration and firmware; the vendor publishes no flash/disk encryption feature. These are the explicitly selected conditions of this document assessment, not a claim about factory defaults or an inspected physical unit.
4
5
Ratings map documented capabilities and the stated configuration to WikiIoT choices. Rare is a qualitative assessment of documented bounded exposure/history, not a measured frequency. Prior attacks is explicitly platform/category-level history; the sources do not identify the Deco X60 as a confirmed victim, and generic internet scanning of routers is not treated as a named compromise. The presence of an HTTP management path alongside WPA3 and cloud HTTPS is rated Partial communications rather than Full. Internal configuration flash with no documented encryption is rated No encryption. Optional capabilities are not treated as enabled unless the assessment configuration states so. Historical CVEs do not imply that the selected current firmware remains vulnerable.
6
7
Release-date scope: 2020-01-05, the date stated in the body of the official TP-Link Deco family unveiling press release distributed via Business Wire (which targeted March 2020 availability); the currently sold hardware revision is marketed on the official page as AX5400 V4.20. Not asserted to be the earliest worldwide retail date.
8
9
Historical vulnerability: no CVE names the Deco X60 itself. Platform-level TP-Link Deco/Archer issues: CVE-2024-21833 (network-adjacent unauthenticated OS command injection; affected Deco X50 before Deco X50(JP)_V1_1.4.1 Build 20231122, Deco XE200 before 1.2.5 Build 20231120, and Archer AX3000/AX5400/AXE75 builds; fixed in the cited later builds), and CVE-2026-15469 (hard-coded mesh group private key in Deco XE75 V3 / XE5300, fixed in 1.5.0 Build 20260603). These are platform-wide, not model-specific to the Deco X60, and are addressed by the OTA update channel.
10
11
No physical device was tested. Keep the configuration and evidence scope with the ratings.
12
13
References:
14
Deco X60 official product page
15
Deco X60 support and download page
16
Deco X60 official datasheet (EU, AX5400)
17
Deco X60 hardware specifications (processor)
18
TP-Link Unveils Deco Mesh Family (Business Wire, 2020-01-05)
19
NVD CVE-2024-21833 — TP-Link LAN command injection
20
TP-Link advisory — hard-coded mesh group private key (CVE-2026-15469)
21
WikiIoT methodology
