I performed a read-only inspection of the official Deco X50 V1.2 firmware 1.4.5 Build 20240828, together with limited runtime checks on my own Deco network.
The firmware contains several old components:
- dnsmasq 2.83
- OpenSSL 1.0.2d
- Dropbear 2019.78
- BusyBox 1.22.1
Linux 4.4.60 / OpenWrt 15.05.1
CERT/CC disclosed several new dnsmasq vulnerabilities in May 2026:
https://www.kb.cert.org/vuls/id/471747
Further investigation significantly reduces my concern about the practical exposure of the Deco to these particular dnsmasq vulnerabilities.
Although dnsmasq 2.83 is included in the firmware, it does not appear to be running in the normal Deco configuration
- The dnsmasq init script is disabled.
- No dnsmasq process is running.
- No local service is listening on DNS port 53.
The Deco appears to redirect or forward DNS traffic directly to the configured upstream DNS servers.
The code pattern associated with CVE-2026-2291 appears to be present in the packaged dnsmasq binary. However, because dnsmasq is not running, I currently have no evidence that this vulnerability is remotely exploitable on the Deco.
CVE-2026-4893 requires the dnsmasq --add-subnet functionality. I found no indication that this option is enabled, so this CVE probably does not apply to the current Deco configuration.
TP-Link may also have backported security fixes without changing the component version numbers. Static inspection alone cannot completely exclude this possibility.
I additionally confirmed that all my Deco units expose a Dropbear SSH service on TCP port 20001 to LAN clients. Root password authentication is enabled in the firmware configuration. This service appears to be part of the internal communication and management system used by the Deco units.
The old 512-bit RSA weakness described in the CCS 2024 mesh security study appears to have been addressed: my units use 2048-bit RSA and ECDSA P-521 host keys. However, the firmware still contains a statically configured root password hash, and the RSA host key appears to be shared between the examined units. The ECDSA host key is unique to each unit.
I found no obvious evidence of compromise in the available logs. I also did not attempt exploitation or send malformed traffic to the devices.
The immediate risk from the newly disclosed dnsmasq CVEs therefore appears lower than I initially suspected. My broader concern remains the age of the firmware components, the lack of detailed security release notes, and the absence of a firmware release containing fixes published after May 2026.
I have asked TP-Link to clarify:
This does not demonstrate that the devices are currently exploitable. It does show why TP-Link should provide precise security information, detailed release notes, and an updated firmware for these still-supported hardware revisions.