CVE-2026-8618
Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus
TP-Link Systems Inc. Deco M9 Plus V2Network & edge
CVSS
7.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.9.2 Build 20260818Deco M9 Plus V2CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.
Text from CVE List
Affected versions 1
- Deco M9 Plus V2affected: all versions before 1.9.2 Build 20260818CVE List