What’s Vulnerable › Vulnerabilities

CVE-2026-8618: Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus

• Severity: high (CVSS 7.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-01
• Weakness: CWE-121

Description

A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.

Affected products

• TP-Link Systems Inc. Deco M9 Plus V2: before 1.9.2 Build 20260818 — fixed in 1.9.2 Build 20260818

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. Deco M9 Plus V2 1.9.2 Build 20260818. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/deco-m9-plus/v2/#Firmware
• https://www.tp-link.com/us/support/download/deco-m9-plus/v2/#Firmware
• https://www.tp-link.com/us/support/faq/5322/

Get alerted when CVE-2026-8618 or the next vulnerability affects your stack