Deco M9 Plus V2 vulnerabilities

2 known vulnerabilities in Deco M9 Plus V2 from TP-Link. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.7 High severity

  Deco M9 Plus V2: Stack-based Buffer Overflow

  CVE-2026-8618Oct 1, 2026TP-Link

  A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful

• 7.7 High severity

  Deco BE11000 V2: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-17176Sep 11, 2026TP-LinkEPSS 15%

  An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete devic