CVE-2026-17176

CVE-2026-17176 is an OS command injection vulnerability (CWE-78) in the TDDP (TP-Link Device Debug Protocol) module of the TP-Link Deco BE11000 mesh Wi-Fi router. An attacker already positioned on an adjacent network segment (the same LAN/Wi-Fi) can trigger it by sending a crafted UDP packet to the device's TDDP service; per the CVSS 4.0 vector (AV:A/PR:N/UI:N with AT:P), no credentials or user interaction are required, but certain atypical environmental conditions must be present for the attack to succeed. Successful exploitation yields arbitrary command execution with root privileges, allowing complete device compromise, unauthorized modification of device settings, and loss of confidentiality, integrity, and availability. Only Deco BE11000 units are implicated by the available data, and practical exposure is limited to attackers who already have a foothold on the local network (e.g., a guest or compromised client device). There are no reports of in-the-wild exploitation, no public proof-of-concept, the flaw is not in CISA's KEV, and no fixed firmware version is specified in the available data.

What to do: No fixed firmware version is listed in the available data, so monitor TP-Link's security advisory page for a patched Deco BE11000 release and apply it as soon as it is published. Until then, reduce adjacent-network risk by keeping untrusted, IoT, and guest devices off the primary LAN segment hosting the Deco units, since the UDP-based attack path requires only local access and grants root. Watch for a public PoC given the simple single-packet attack surface, and treat any report of LAN-side scanning of UDP debug services as a signal to prioritize patching.