EUVD-2026-75886
GHSA-g92m-rv6c-v268
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only vector per description; no authentication or user interaction required; full CIA impact on the device; scope unchanged as impact is contained to the router.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
3DescriptionCVE.org
An OS command injection vulnerability in the TDDP module of Deco BE11000 allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet.
Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability
AnalysisAI
OS command injection in TP-Link Deco BE11000 V2's TDDP (TP-Link Device Debug Protocol) module enables unauthenticated adjacent-network attackers to execute arbitrary commands with root privileges by sending a single crafted UDP packet. The vulnerability results in complete device compromise, covering unauthorized command execution, configuration modification, and total loss of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be on an adjacent network segment - the same broadcast domain, Wi-Fi network, or directly connected LAN - as the targeted Deco BE11000 V2; remote internet-based exploitation is not possible given AV:A. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 captures a meaningful balance of high impact and constrained attack vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released firmware patch by downloading the latest Deco BE11000 firmware from https://www.tp-link.com/us/support/download/deco-be11000/#Firmware and following the update procedure at https://www.tp-link.com/en/support/faq/5293/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, locate and document all TP-Link Deco BE11000 V2 units in your environment with their current firmware versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today