Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-17176

OS Command Injection Vulnerability in Deco Devices

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 1.3.5 Build 26071712, 1.9.2 Build 20260818
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability

Affected versions

  • TP-Link Systems Inc. Deco BE11000 V2

    fixed in 1.3.5 Build 26071712

  • TP-Link Systems Inc. Deco M9 Plus V2

    fixed in 1.9.2 Build 20260818

References 4

tp-link.com