Solution Enhancing Network Stability and Security Database Update in Deco M5/M9 Plus1.9.1
Solution Enhancing Network Stability and Security Database Update in Deco M5/M9 Plus1.9.1
This Article Applies to:
Deco M5(EU/US)_V1/V2/3/V3.2
Deco M9 Plus(EU/US)_V2/V2.2
Deco X20(EU/US)_V1/V1.2
Deco X60(EU/US)_V1/V2
Hi All,
Over the past month, we have received user feedback regarding the Deco M5/Deco M9 Plus_1.9.1, also Deco X20/Deco X60_1.6.1. There are mainly the following three types:
The incorrect attacking records detected by Network Intrusion Prevention
including but not limited to
Classification |
Status |
| Blocked IP:194.168.4.100 Classification: CNC attack |
Fixed |
| ICMP (CVE-2015-7759) | |
| CVE-technet.microsoft.com/en-us/secuSERVER-IIS_encoding_access | |
| SNMP(CVE-2002-0013) | Fixed |
| CVE-technet.microsoft.com/en-us/secuOS-WINDOWS_Microsoft_Windows_TCP_print_sevice_overflow-attempt | |
| CVE-tools.cisco.com/security/cernter/protocol-SNMP_public_access_upd | |
| CVE-2017-7285 OS-LINUX_Linux-Kernel_Challenge_ACK_provocation_attempt |
The random blocking of safe websites/domains by Malicious Content Filter
including but not limited to
Websites |
Potential Impact |
Status |
Classification: Malware |
|
Fixed The Content Classification rules in the Cloud have been updated to prevent false Malware alarms from being triggered. |
The satellite Deco units are green and working well, but the Deco App reported "offline"
-
Please refer to this link to help me submit the Deco App log: How to submit Deco APP log
(After submitting the APP log, please comment below with the ticket ID No.)
-
Starting with the Deco M5_V1/V2/V3/V3.2, a beta firmware has been developed to address the behaviors. We recommend that affected users install the firmware from the links below. As we gather feedback and verify the fix, similar patches will be applied to other affected models.
Deco M5_1.9.0_build_20250926_Beta
Please be sure you have read the Beta Test Agreement before upgrading the Pre-release firmware!
If you noticed certain unusual network behaviors, such as frequent connection dropouts, please check whether there were any suspicious records under Network Security. However, if your experience with Deco has no obvious connection with the mentioned issues, please start a new post with more details so that our engineer can address the matter promptly.
For users who had a similar issue but the attacking/blocking records are not included, please comment between with the Deco model number/firmware versions and a screenshot of the attacking/blocking record.
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
I run a Deco X20 1.6.1 Build 20250831 Rel 77853
The Security issue for the firewall was on only on the new firmware released this year (with the Homeshield enhanced parental controls option now added for those still on Homecare)
Dropouts are happening (still get a couple) but its bearable - no more than what I was having before this FW.
All firewall logs for internal LAN requests are gone since the Intrusion Protection was updated last weekend.
Recommend to reboot all Decos and then reboot all devices
- Copy Link
- Report Inappropriate Content
↵
Hi David. Here we go again, disruption that needs to be investigated.
Major block of internet access that might be possible to trace.
Log forwarded in Ticket TKID251109419
The question is
-
If Laptop is the issue, why isn’t the client isolated or blocked instead of complete WAN block?
-
What caused this disruption and block?
-
Its recommend to use Google's DNS. However the custom should be able to pick whatever DNS they want? Also a website blocked should not block the whole network/WAN?
UPDATE November 6th 08:00 . After doing some more research. It looks like TP-Link cant be used with any DNS service. This is way out of my knowledge zone and I am trying to understand the reason behind it. Don't know why or who is to blame. Example There are plenty of posts online from others having the same experience. Also its not only the TP Link brand, looks like others can have the same issue. One of the DNS services, quad9, don't seem to work with example TP Link routers and some other brands. If I get the time I need to dig into why and where the problem sits.
| Firmware | 1.9.1 Build 20250926 Rel. 53742 | |
|---|---|---|
| 1 | When | Block: 5 Nov about 09:20:00-09:25:00 Internet returned working when checked 09:40:00 without restart/reboot of system. Critical Log: |
| 2 | Did? | On the HP-Laptop, browsing to website from google search in Chrome browser. Visiting link: https://community.home-assistant.io/t/sonos-favorites/835866 The website cannot be reached. The same website could be reached after the block went away. No issue. On the HP-Laptop, browsing to website from google search in Chrome browser. Visiting link: https://community.home-assistant.io/t/sonos-favorites/835866 The website cannot be reached. The same website could be reached after the block went away. No issue. |
| 3 | Client | Was used when event triggered. HP Laptop Windows 11 Home SSID: norrvana_surf |
| 4 | Disruption |
|
- Copy Link
- Report Inappropriate Content
Hi, I hope you can give an update on the support ticket# TKID251062808, as the case has been escalated to the senior engineer directly(the APP log was also merged into TKID251062808 ). I can no longer help with the logs, and the engineer will continue to provide further assistance.
Thank you very much.
Best regards.
- Copy Link
- Report Inappropriate Content
Thanks. Grateful for all your help and for responding to our cry for help.
However after all the problems, previous ones + the resent major disruption caused by firmware updates in September/October. It has caused so much trouble. It has been unacceptable. After all the time spent troubleshooting, writing on this forum... All confidence in your company and products are gone. ALL TP-LINK products are now going in the trash.
The network and Deco's will be replaced asap, I am currently looking at a new system. Top priority.
Good luck to everyone.
- Copy Link
- Report Inappropriate Content
Hi, thanks a lot for the update.
After the recent security database update, you might notice the reported Malware issue here has gradually phased out. But we still apologize for any inconvenience this may have caused.
As you also mentioned that the disconnection of Deco also coincides with the disruption of the internet provider, there is no conclusive evidence that the latest firmware of Deco would be a culprit. Further troubleshooting indeed can be time-consuming. In case there is a potential hardware issue due to prolonged usage, it is also recommended to reach out to the local support team to check for warranty service(Deco has a 3-year warranty in Sweden).
Thank you very much for your understanding and support.
Best regards.
- Copy Link
- Report Inappropriate Content
A factory reset did fix it. But what caused the unusual break in the first place? I only started using Deco m5 about 1 year ago. It was a pain to setup the whole network again including resetting all 3 other Deco units.
Secondly, with 1.9.1,the Deco app doesn't display the clients correctly. Many online clients are shown as offline.
I have tried the new beta firmware 2509, but with that firmware, my internet connection will become unstable and become unavailable every 5-10mins. Downgrading firmware fixed that issue.
- Copy Link
- Report Inappropriate Content
It's been about 2 months with serious issues with my M9 plus network following firmware 1.9.1. Despite my messages to TP-Link including logs nothing has been resolved in 2 months. Similar to others I've decided to abandon my M9 plus network and have now replaced my mesh network with an alternative manufacturer - the result is that all my issues were resolved instantly. All my network devices are now working again.
I feel as others very much let down by tp-link regarding my M9 plus network which worked perfectly well until firmware 1.9.1 was released. You have lost another tp-link mesh user, never again!
- Copy Link
- Report Inappropriate Content
I also have problems with the latest Deco M9 Plus firmware V1.9.1 Build 20250612 Rel. 45690.
I use the Deco in Access Point Mode.
I upgraded from firmware V1.6.4 to V1.9.1 (did not change any hardware-related things), and noticed that from now on the webpage http://tplinkdeco.net was not reachable anymore via Firefox (which I always used).
Furthermore, using the Deco-app on my mobile phone, I noticed that with V1.9.1 some clients (not all) do not have their IP-address shown (see att. picture), although these clients do function well.
Resetting all the hardware (Deco, Modem/Router, Switch, Mobile phone and all clients) did not solve the IP-address-issue.
Downgrading the firmware to the previously used V1.6.4 immediately solved this: now all client's IP-addresses are shown again.
And http://tplinkdeco.net (via Firefox) also does work again.
Regards,
Wim.

- Copy Link
- Report Inappropriate Content
Information
Helpful: 0
Views: 716
Replies: 18
Voters 0
No one has voted for it yet.

