TP-Link Deco M9 Plus TDDPv2 service /usr/bin/tddp subtype 0x91 handler buffer overflow

Summaryinfo

A vulnerability identified as very critical has been detected in TP-Link Deco M9 Plus. The impacted element is the function subtype 0x91 handler of the file /usr/bin/tddp of the component TDDPv2 service. This manipulation causes buffer overflow. This vulnerability is handled as CVE-2026-8618. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in TP-Link Deco M9 Plus (affected version not known) and classified as very critical. Affected by this vulnerability is the function subtype 0x91 handler of the file /usr/bin/tddp of the component TDDPv2 service. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.

It is possible to read the advisory at tp-link.com. This vulnerability is known as CVE-2026-8618 since 05/14/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/01/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• TP-Link

Name

• Deco M9 Plus

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion