You do not have permission to edit this page, for the following reasons:
Documentation-based security assessment: TP-Link Deco X60 (AX5400 Whole Home Mesh Wi-Fi 6 System). Reviewed 2026-10-24. 2 3 Documentation-based assessment of a defined Deco X60 profile managed through the Deco app bound to a TP-Link ID cloud account. Initial onboarding creates the account and sets the Wi-Fi password; there is no shared default admin credential. Wireless clients use WPA2/WPA3-Personal. Remote/app management reaches the device over the vendor cloud; the local web service is reachable on both HTTP port 80 and HTTPS 443 in the documented default service set. Firmware updates are delivered as automatic OTA builds published on the support/download page. The physical reset button on the unit is retained. Internal flash holds configuration and firmware; the vendor publishes no flash/disk encryption feature. These are the explicitly selected conditions of this document assessment, not a claim about factory defaults or an inspected physical unit. 4 5 Ratings map documented capabilities and the stated configuration to WikiIoT choices. Rare is a qualitative assessment of documented bounded exposure/history, not a measured frequency. Prior attacks is explicitly platform/category-level history; the sources do not identify the Deco X60 as a confirmed victim, and generic internet scanning of routers is not treated as a named compromise. The presence of an HTTP management path alongside WPA3 and cloud HTTPS is rated Partial communications rather than Full. Internal configuration flash with no documented encryption is rated No encryption. Optional capabilities are not treated as enabled unless the assessment configuration states so. Historical CVEs do not imply that the selected current firmware remains vulnerable. 6 7 Release-date scope: 2020-01-05, the date stated in the body of the official TP-Link Deco family unveiling press release distributed via Business Wire (which targeted March 2020 availability); the currently sold hardware revision is marketed on the official page as AX5400 V4.20. Not asserted to be the earliest worldwide retail date. 8 9 Historical vulnerability: no CVE names the Deco X60 itself. Platform-level TP-Link Deco/Archer issues: CVE-2024-21833 (network-adjacent unauthenticated OS command injection; affected Deco X50 before Deco X50(JP)_V1_1.4.1 Build 20231122, Deco XE200 before 1.2.5 Build 20231120, and Archer AX3000/AX5400/AXE75 builds; fixed in the cited later builds), and CVE-2026-15469 (hard-coded mesh group private key in Deco XE75 V3 / XE5300, fixed in 1.5.0 Build 20260603). These are platform-wide, not model-specific to the Deco X60, and are addressed by the OTA update channel. 10 11 No physical device was tested. Keep the configuration and evidence scope with the ratings. 12 13 References: 14 [https://www.tp-link.com/en/home-networking/deco/deco-x60/ Deco X60 official product page] 15 [https://www.tp-link.com/en/support/download/deco-x60/ Deco X60 support and download page] 16 [https://static.tp-link.com/upload/product-overview/2022/202208/20220810/Deco%20X60%28EU%29%203.2_Datasheet.pdf Deco X60 official datasheet (EU, AX5400)] 17 [https://www.tp-link.com/zh-hk/home-networking/deco/deco-x60(3-pack)/ Deco X60 hardware specifications (processor)] 18 [https://www.businesswire.com/news/home/20200105005033/en/TP-Link-Unveils-Deco-Mesh-Family-Complete-Line/ TP-Link Unveils Deco Mesh Family (Business Wire, 2020-01-05)] 19 [https://nvd.nist.gov/vuln/detail/CVE-2024-21833 NVD CVE-2024-21833 — TP-Link LAN command injection] 20 [https://www.tp-link.com/us/support/faq/5263/ TP-Link advisory — hard-coded mesh group private key (CVE-2026-15469)] 21 [https://fehmijaafar.net/wiki-iot/index.php/Methodology WikiIoT methodology]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
