CVE-2026-17176CWE-78command-injection

CVE-2026-17176

published September 11, 2026

CVSS
7.7
EPSS
5%
Percentile
92.2
In the wild
Unconfirmed
What it is

An OS

command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an

adjacent network attacker to execute arbitrary commands with root privileges by

sending a crafted UDP packet.

Successful exploitation may lead to complete

device compromise, including unauthorized command execution, modification of

device settings, and loss of confidentiality, integrity, and availability

The record
Technical detail
CVSS
7.7 · NONE
CVSS v4.0
7.7 · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.04974 · 92.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-11T04:17Z
References (4)
https://www.tp-link.com/en/support/download/deco-m9-plus/v2/ · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/faq/5293/ · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/download/deco-be11000/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/download/deco-m9-plus/v2/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630
EPSS history
Timeline
  • 12 SEP 03:19Z
    EPSS moved — → 4%
    epss
  • 10 SEP 23:14Z
    OS command injection Vulnerability in Deco BE11000
    cvelistv5