Deviceways

Router

TP-LINK Deco M5

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

Hardwarev1; v3; v2

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
v2
v3
v1
Open device guideopenwrt.org
Original project github.com

v1

First installation
U-Boot web recovery

v3

First installation
U-Boot web recovery

v2

First installation
U-Boot web recovery
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

TP-LINK Deco M5 — TechInfoDepot (github.com)TP-LINK Deco M5 — WikiDevi (github.com)

Hardware revision
v1.0

Device details

Device details — Source documentation (openwrt.org)

Hardware revision
v1

OpenWrt · v1

OpenWrt · v1 — Source documentation (openwrt.org)

Installation routes recorded
U-Boot web recovery
Availability recorded by source
Available 2026

Device details

Device details — Source documentation (openwrt.org)

Hardware revision
v3

OpenWrt · v3

OpenWrt · v3 — Source documentation (openwrt.org)

Installation routes recorded
U-Boot web recovery
Availability recorded by source
Available 2026

Device details

Device details — Source documentation (openwrt.org)

Hardware revision
v2

OpenWrt · v2

OpenWrt · v2 — Source documentation (openwrt.org)

Installation routes recorded
U-Boot web recovery
Availability recorded by source
Available 2026

Hardware differences

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 7.1 (v4.0)

Deco M5 Deco M5 V1

Weak Password Hashing Mechanism in TP-Link Deco M5

CVE-2026-5040

Affected firmware
Before 1.9.4 Build 20260312 Rel.17129
Fix
Fix details in the linked record
Read TPLink CVE record
Details and sources
CVE updated

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks.

Successful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality.

Check more security advisories for this device · CVE.org