CVE-2026-8618

High

Description

A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.

SeverityHigh

CVSS7.7

Exploit probability—

ProductDeco M9 Plus V2

PublishedOct 1, 2026

First seenOct 1, 2026

Weakness typeCWE-121CWE-121

How to fix

Update

TP-Link Systems Inc. Deco M9 Plus V21.9.2 Build 20260818 or later

Patches

Vendor advisories

tp-link.com/us/support/faq/5322/

Affected products

Product	Affected versions	Fixed in
TP-Link Systems Inc. Deco M9 Plus V2	v < 1.9.2 Build 20260818	1.9.2 Build 20260818

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.