CVE-2026-8618
Received Received - Intake

Stack-Based Buffer Overflow in Deco M9 Plus TDDP Service

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: TPLink

Description
A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-8618
EUVD
EUVD-2026-91006

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-8618 is a stack-based buffer overflow in the TDDPv2 service of TP-Link Deco M9 Plus devices. It occurs due to insufficient validation of decrypted request data length before copying it into a fixed-size stack buffer in the subtype 0x91 handler. An adjacent unauthenticated attacker could exploit this during device setup by sending crafted TDDP packets to cause denial of service or arbitrary code execution.

Detection Guidance

Detecting this vulnerability requires checking if your Deco M9 Plus is running vulnerable firmware. Verify the firmware version via the device admin interface or by inspecting the firmware file. Use network scanning tools like nmap to identify TDDPv2 service (port 20002) on the device. Monitor for unusual traffic patterns or crashes during device setup.

Impact Analysis

This vulnerability may allow an attacker to crash your device or take control of it during setup. If exploited, it could disrupt your network, compromise connected devices, or enable unauthorized access. Users should update firmware to version 1.9.2 Build 20260818 or later to mitigate risks.

Mitigation Strategies

Immediately update the Deco M9 Plus firmware to version 1.9.2 Build 20260818 or later. Download firmware only from official TP-Link regional websites. Use a wired connection for the update and ensure uninterrupted power during the process. Disable remote access to the device if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart