CVE-2026-17176
High
Description
An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability
SeverityHigh
CVSS7.7
Exploit probability—
ProductDeco BE11000 V2
PublishedSep 11, 2026
First seenSep 11, 2026
Weakness typeCWE-78OS command injection
How to fix
Update
- TP-Link Systems Inc. Deco BE11000 V21.3.5 Build 26071712 or later
- TP-Link Systems Inc. Deco M9 Plus V21.9.2 Build 20260818 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TP-Link Systems Inc. Deco BE11000 V2 | v < 1.3.5 Build 26071712 | 1.3.5 Build 26071712 |
| TP-Link Systems Inc. Deco M9 Plus V2 | v < 1.9.2 Build 20260818 | 1.9.2 Build 20260818 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.