CVE-2026-8618— Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus
Quick assessment
Affected
TP-Link Systems Inc. Deco M9 Plus V2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Deco M9 Plus 设备上的 TDDPv2 服务（/usr/bin/tddp）中存在一个基于栈的缓冲区溢出漏洞。该漏洞源于在将解密后的请求数据复制到固定大小的栈缓冲区之前，未对数据长度进行充分验证（具体发生在子类型 0x91 的处理程序中）。成功利用此漏洞可能允许相邻的未认证攻击者通过构造恶意的 TDDP 数据包，在设备配置阶段触发拒绝服务（DoS）或实现任意代码执行。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-8618
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus
Source: CVE Program / CVE List V5
Vulnerability Description
A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TP-Link Systems Inc. | Deco M9 Plus V2 | 0 ~ 1.9.2 Build 20260818 | - |
|
II. Public POCs for CVE-2026-8618
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8618
请登录查看更多情报信息。
Other References for CVE-2026-8618 (3)
-
https://www.tp-link.com/us/support/faq/5322/ vendor-advisory
Same Patch Batch · TP-Link Systems Inc. · 2026-10-01 · 6 CVEs total
| CVE-2026-102369 | 8.7 HIGH | Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & |
| CVE-2026-84682 | 7.7 HIGH | TDDPv2 setProductVer Command Injection in Archer AX90 |
| CVE-2026-9032 | 7.1 HIGH | Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerabilit |
| CVE-2026-78578 | 7.1 HIGH | Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Servic |
| CVE-2026-78577 | 5.3 MEDIUM | Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200 |
IV. Related Vulnerabilities
Same vendor: TP-Link Systems Inc.
-
CVE-2026-84682
TDDPv2 setProductVer Command Injection in Archer AX90 -
CVE-2026-102369
Unauthenticated Remote Code Execution via MacTool Command In -
CVE-2026-78578
Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Re -
CVE-2026-78577
Unauthenticated Onboarding Scan Information Disclosure in TP -
CVE-2026-9032
Unauthenticated Onboarding Connect NULL Pointer Dereference
Same weakness: CWE-121
-
CVE-2026-63292
Apache HTTP Server: mod_vhost_alias stack overflow -
CVE-2026-12627
Fortra's Core Privileged Access Manager (BoKS) autoregistrat -
CVE-2026-103531
OpenSC card-setcos.c setcos_construct_fci_44 stack-based ove -
CVE-2026-47506
NVIDIA Windows驱动YCbCr420处理栈溢出致拒绝服务 -
CVE-2026-47593
NVIDIA Windows驱动越界写致提权漏洞
V. Comments for CVE-2026-8618
No comments yet