CVE-2026-84682

Published: Ott 01, 2026 Last Modified: Ott 01, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,7
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Attack Vector: adjacent
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. 

Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.

78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability Non-Repudiation
Potential Impacts:
Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Read Files Or Directories Modify Files Or Directories Read Application Data Modify Application Data Hide Activities
Applicable Platforms
Technologies: Not Technology-Specific, AI/ML, Web Server
Likelihood of Exploit: High
View CWE Details
https://www.tp-link.com/en/support/download/archer-ax90/v1/…
https://www.tp-link.com/en/support/download/archer-ax90/v1/#Firmware
https://www.tp-link.com/us/support/download/archer-ax90/v1/…
https://www.tp-link.com/us/support/download/archer-ax90/v1/#Firmware
https://www.tp-link.com/us/support/faq/5323/
https://www.tp-link.com/us/support/faq/5323/