CVE-2026-17176

UNKNOWN 0.0

OS Command Injection Vulnerability in Deco Devices

CVSS Score

0.0

EPSS Score

3.7%

EPSS Percentile

89th

An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability

CWE	CWE-78
Vendor	tp-link systems inc.
Product	deco be11000 v2
Published	Sep 10, 2026
Last Updated	Oct 1, 2026

Stay Ahead of the Next One

Get instant alerts for tp-link systems inc. deco be11000 v2

Be the first to know when new unknown vulnerabilities affecting tp-link systems inc. deco be11000 v2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

TP-Link Systems Inc. / Deco BE11000 V2

0 < 1.3.5 Build 26071712

TP-Link Systems Inc. / Deco M9 Plus V2

0 < 1.9.2 Build 20260818

References

NVD ↗ CVE.org ↗ EPSS Data ↗

tp-link.com: https://www.tp-link.com/us/support/download/deco-be11000/#Firmware tp-link.com: https://www.tp-link.com/en/support/faq/5293/ tp-link.com: https://www.tp-link.com/en/support/download/deco-m9-plus/v2/ tp-link.com: https://www.tp-link.com/us/support/download/deco-m9-plus/v2/#Firmware

Credits

Isa Roovers