Deco M9 Plus V2
Monthly
Stack-based buffer overflow in the TDDPv2 service (/usr/bin/tddp) on TP-Link Deco M9 Plus v2 mesh units lets a network-adjacent, unauthenticated attacker crash the device or potentially execute arbitrary code, but only while the unit is in its setup/provisioning phase. A crafted TDDP request whose decrypted payload is longer than the fixed-size stack buffer used by the subtype 0x91 handler (CWE-121) triggers the overflow with no user interaction. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; TP-Link has published fixed firmware. The risk is genuine but conditionally gated: the attacker must already sit on the same Wi-Fi/link-local segment during onboarding, which substantially narrows realistic exposure.
Stack-based buffer overflow in the TDDPv2 service (/usr/bin/tddp) on TP-Link Deco M9 Plus v2 mesh units lets a network-adjacent, unauthenticated attacker crash the device or potentially execute arbitrary code, but only while the unit is in its setup/provisioning phase. A crafted TDDP request whose decrypted payload is longer than the fixed-size stack buffer used by the subtype 0x91 handler (CWE-121) triggers the overflow with no user interaction. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; TP-Link has published fixed firmware. The risk is genuine but conditionally gated: the attacker must already sit on the same Wi-Fi/link-local segment during onboarding, which substantially narrows realistic exposure.