A stack-based buffer overflow exists in the TDDPv2 service ("/usr/bin/tddp") on Deco M9 Plus. The vulnerability arises from insufficient validation of the length of decrypted request data before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. An unauthenticated attacker can exploit this flaw during the device setup phase by sending crafted TDDP packets, potentially causing a denial of service or enabling arbitrary code execution by manipulating the service.

TP‑Link Systems Inc. Deco M9 Plus V2 is affected. No other vendors or product lines are listed, and the impact applies to the device’s firmware version(s) that contain the vulnerable TDDPv2 handler.

The CVSS score of 7.7 indicates high severity, yet the EPSS score is not available and the vulnerability is not in the CISA KEV catalog. Attacks would need to target the device during its setup process before authentication, suggesting a remote and unauthenticated exploit path. If successful, the attacker could execute arbitrary code or crash the device, compromising confidentiality, integrity, and availability.