{"id":"CVE-2026-8618","published":"2026-10-01T19:17:25.340","lastModified":"2026-10-01T20:36:38.330","description":"A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://www.tp-link.com/en/support/download/deco-m9-plus/v2/#Firmware","tags":[]},{"url":"https://www.tp-link.com/us/support/download/deco-m9-plus/v2/#Firmware","tags":[]},{"url":"https://www.tp-link.com/us/support/faq/5322/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}