RCE in TP-Link Systems Inc. Deco Be11000 V2

CVE-2026-17176

An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability

Vulnerability class: Command Injection (OS Command Injection)

Published · last modified .

EPSS exploit prediction

EPSS: 0.150 (96.7th percentile), scored .

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-17176: rose from 0.037 to 0.150.

EPSS over last 30 days · oldest: 0.037 · newest: 0.150 · change: +0.113

Affected products

Weakness classification (CWE)

References