CVE-2026-17176 in the critical feed json
OS Command Injection Vulnerability in Deco Devices
published 2026-09-10 59 d ago modified 2026-10-01 38 d ago also EUVD-2026-75886
- cvss
- 7.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 15.0%
- EPSS 15.0% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet.
Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability
Patch / fix
- TP-Link Systems Inc. Deco BE11000 V2 1.3.5 Build 26071712
- TP-Link Systems Inc. Deco M9 Plus V2 1.9.2 Build 20260818
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 58 d ago
Exploit prediction
14.99% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- TP-Link Systems Inc. Deco BE11000 V2
- TP-Link Systems Inc. Deco M9 Plus V2
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
Sources
- CVE List CVE-2026-17176
- NVD CVE-2026-17176
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.