CVE-2026-8618: Deco M9 Plus Buffer Overflow Vulnerability

CVE-2026-8618 Overview

CVE-2026-8618 is a stack-based buffer overflow [CWE-121] in the TDDPv2 service (/usr/bin/tddp) running on the TP-Link Deco M9 Plus mesh router. The service fails to validate the length of decrypted request data before copying it into a fixed-size stack buffer within the subtype 0x91 handler. An adjacent, unauthenticated attacker on the same network segment can send crafted TP-Link Device Debug Protocol (TDDP) packets during the device setup phase. Successful exploitation causes denial of service or achieves arbitrary code execution on the device.

Critical Impact
Unauthenticated adjacent attackers can trigger arbitrary code execution on Deco M9 Plus devices during setup, compromising the mesh router and the networks it serves.

Affected Products

TP-Link Deco M9 Plus mesh Wi-Fi router
TDDPv2 service binary (/usr/bin/tddp)
Device firmware prior to the vendor-provided fix (see TP-Link Deco M9 Plus Firmware)

Discovery Timeline

2026-10-01 - CVE-2026-8618 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-8618

Vulnerability Analysis

The TDDPv2 service listens for TP-Link Device Debug Protocol packets, which the Deco M9 Plus uses during provisioning and administrative operations. Each request contains a type and subtype field that routes the payload to a specific handler. The subtype 0x91 handler decrypts the request body and then copies the decrypted content into a fixed-size buffer allocated on the stack. The handler does not verify that the decrypted length fits the destination buffer. An attacker who controls the ciphertext controls the plaintext length, enabling overflow of the stack frame including the saved return address.

The vulnerability is reachable before authentication because TDDPv2 processes setup-phase packets prior to any credential check. Exploitation occurs across the adjacent network, requiring the attacker to reach the device on the local Wi-Fi or LAN segment.

Root Cause

The root cause is missing bounds checking between the decryption routine and the stack copy operation in the subtype 0x91 handler. The code trusts the attacker-controlled decrypted length as the copy size, satisfying the classic conditions for CWE-121 stack-based buffer overflow.

Attack Vector

An attacker joins the adjacent network and sends a crafted TDDP packet with a valid header, subtype 0x91, and an encrypted payload whose decrypted length exceeds the target stack buffer. The overflow corrupts stack metadata and can redirect execution to attacker-supplied shellcode or ROP chains, yielding code execution in the context of the tddp process on the device.

No verified public exploit code is available. See the vendor references for authoritative technical details.

Detection Methods for CVE-2026-8618

Indicators of Compromise

Unexpected TDDP (UDP/1040) traffic originating from unmanaged or guest clients on the LAN or Wi-Fi segment hosting the Deco mesh.
tddp process crashes, restarts, or unexpected /usr/bin/tddp core dumps on Deco M9 Plus devices.
Deco M9 Plus devices re-entering setup mode or exhibiting unexplained reboots following receipt of large TDDP packets.

Detection Strategies

Deploy network sensors that parse UDP/1040 TDDP traffic and alert on packets with subtype 0x91 originating from non-administrative hosts.
Baseline normal TDDP traffic patterns during provisioning and flag deviations in packet length or frequency.
Correlate wireless association events with subsequent TDDP packet floods to identify rogue adjacent clients.

Monitoring Recommendations

Forward router syslog, DHCP, and wireless association logs to a centralized analytics platform for correlation.
Monitor firmware version reporting across the fleet of Deco M9 Plus units to confirm patch coverage.
Alert on new or unknown devices joining the management SSID, especially during off-hours.

How to Mitigate CVE-2026-8618

Immediate Actions Required

Apply the latest firmware for Deco M9 Plus (v2) from the TP-Link firmware download page.
Restrict access to the management SSID and segment IoT or guest clients onto isolated VLANs that cannot reach TDDP services.
Complete device setup and provisioning on a trusted, isolated network before deploying units into production environments.

Patch Information

TP-Link publishes updated firmware for the Deco M9 Plus on its official support site. Review the vendor advisory and firmware notes on the TP-Link Deco M9 Plus FAQ and apply the fixed firmware release to every mesh node. Verify the running version on each node after the update completes.

Workarounds

Disable or firewall UDP/1040 at network boundaries where the Deco management plane does not need to be reachable.
Enforce WPA3 or strong WPA2 credentials on all SSIDs served by the mesh to limit adjacent network access.
Avoid performing device setup on untrusted networks where unknown adjacent clients may be present.

bash

# Example: block external TDDP (UDP/1040) ingress at an upstream firewall
iptables -A FORWARD -p udp --dport 1040 -i $WAN_IF -j DROP
iptables -A INPUT   -p udp --dport 1040 -i $WAN_IF -j DROP