TP-Link Systems Inc Deco m9 Plus v2 vulnerabilities

2 CVEs affecting TP-Link Systems Inc Deco m9 Plus v2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-8618, published 2026-10-01.

More from TP-Link Systems Inc.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-17176, published 2026-09-11. High severity, CVSS 7.7. EPSS: 5% chance of exploitation in the next 30 days. An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted…
• CVE-2026-8618, published 2026-10-01. High severity, CVSS 7.7. EPSS: 0.2% chance of exploitation in the next 30 days. A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a…