CVE-2026-17176: OS command injection Vulnerability in Deco BE11000
An OS command injection vulnerability in the TDDP module of Deco BE11000 allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet.
Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be on an adjacent network and able to send a crafted UDP packet to the affected device. Remote attackers without adjacent network access are not identified as exploitable from the available information.
What level of access could an attacker obtain?
Successful exploitation allows arbitrary command execution with root privileges. This can result in complete device compromise, including changes to device settings and loss of confidentiality, integrity, and availability.
How can I determine whether my device is affected?
The available information identifies Deco BE11000 and its TDDP module as affected. Consult the vendor firmware download and support FAQ references for applicable firmware and remediation information.