Deco M9 Plus CVE-2026-8618

Exploitation requires the attacker to be on the same adjacent/link-local network as the target (AV:A) - e.g., associated to the Wi-Fi or on the same L2 segment - and to reach the TDDPv2 service (/usr/bin/tddp) on a Deco M9 Plus v2. The critical limiting factor, encoded as AT:P, is that the vulnerable subtype 0x91 handler is reachable 'during the device setup phase,' so the attacker must act within that provisioning window rather than against a steady-state deployed device. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the attacker must be able to craft a TDDP packet whose decrypted request data exceeds the fixed-size stack buffer. The adjacency requirement and setup-phase timing together substantially narrow realistic exploitation to a proximate attacker present during device onboarding.

This is a genuine but conditionally-gated risk. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N) confirms an adjacent-network, unauthenticated vector with no user interaction, and high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H), supporting RCE on an embedded network device - a serious outcome. However, two signals temper the real-world priority. First, AV:A (not AV:N) means the attacker must already be on the same adjacent/link-local network (e.g., Wi-Fi association or same L2 segment), not the open Internet. Second, AT:P (Attack Requirements: Present) encodes the description's key constraint: exploitation is tied to the 'device setup phase,' a transient window rather than a steady-state service. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active or widespread exploitation (see exploitation status). The vendor-published CVSS of 7.7 (High) is consistent with the vector. Net: a legitimate High-severity embedded RCE worth patching promptly, but the adjacency requirement and setup-phase timing make opportunistic mass exploitation unlikely; realistic threat is a local/proximate attacker during provisioning. No conflicting signals were observed between the vector and the description - both point to adjacent, unauthenticated access during setup.

An attacker on the same local network segment as a Deco M9 Plus v2 being provisioned sends a crafted TDDP subtype 0x91 packet whose decrypted payload exceeds the fixed-size stack buffer. The resulting stack-based buffer overflow (CWE-121) crashes the tddp service (denial of service) or is leveraged to execute arbitrary code on the device during its setup phase. No public exploit code was identified in the provided intelligence, so this scenario is inferred from the vulnerability description and CVSS vector rather than a demonstrated exploit.