Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-8618: Deco M9 Plus allows remote takeover during setup
CVE-2026-8618 · published 1 month ago
Summary
The Deco M9 Plus router can be tricked during its initial configuration into running malicious code or crashing, because it does not properly check the size of certain setup messages. This could let a nearby attacker take control of the device or make it stop working. Install the latest firmware from TP-Link and keep the router on a separate network until it is fully configured.
What to do
- Update tp-link systems inc. deco m9 plus v2 to version 1.9.2 Build 20260818 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tp-link systems inc. | deco m9 plus v2 | < 1.9.2 Build 20260818 |
Original advisory text
Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus
A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.7
High
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published1 Oct 2026
Updated4 Nov 2026
First seen1 Oct 2026
Track software like this
Free during beta