{"id":"CVE-2026-17176","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-17176","summary":"An OS\ncommand injection vulnerability in the TDDP module of Deco BE11000 allows an\nadjacent network attacker to execute arbitrary commands with root privileges by\nsending a crafted…","details":"An OS\ncommand injection vulnerability in the TDDP module of Deco BE11000 allows an\nadjacent network attacker to execute arbitrary commands with root privileges by\nsending a crafted UDP packet.\n\n\n\nSuccessful exploitation may lead to complete\ndevice compromise, including unauthorized command execution, modification of\ndevice settings, and loss of confidentiality, integrity, and availability","published":"2026-09-11T00:17:26.707","modified":"2026-09-11T15:21:12.850","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://www.tp-link.com/en/support/faq/5293/"},{"type":"WEB","url":"https://www.tp-link.com/us/support/download/deco-be11000/#Firmware"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-11T15:21:12.850"}}