CVE-2026-84682— TDDPv2 setProductVer Command Injection in Archer AX90
Quick assessment
Affected
TP-Link Systems Inc. Archer AX90 v1
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device bo
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84682
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TDDPv2 setProductVer Command Injection in Archer AX90
Source: CVE Program / CVE List V5
Vulnerability Description
A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot.
Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TP-Link Systems Inc. | Archer AX90 v1 | 0 ~ 1.1.4 Build 20260927 | - |
|
II. Public POCs for CVE-2026-84682
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84682
请登录查看更多情报信息。
Other References for CVE-2026-84682 (3)
-
https://www.tp-link.com/us/support/faq/5323/ vendor-advisory
Same Patch Batch · TP-Link Systems Inc. · 2026-10-01 · 6 CVEs total
| CVE-2026-102369 | 8.7 HIGH | Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & |
| CVE-2026-8618 | 7.7 HIGH | Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x9 |
| CVE-2026-9032 | 7.1 HIGH | Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerabilit |
| CVE-2026-78578 | 7.1 HIGH | Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Servic |
| CVE-2026-78577 | 5.3 MEDIUM | Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200 |
IV. Related Vulnerabilities
Same vendor: TP-Link Systems Inc.
-
CVE-2026-8618
Pre-Authentication Stack-based Buffer Overflow Remote Code E -
CVE-2026-102369
Unauthenticated Remote Code Execution via MacTool Command In -
CVE-2026-78578
Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Re -
CVE-2026-78577
Unauthenticated Onboarding Scan Information Disclosure in TP -
CVE-2026-9032
Unauthenticated Onboarding Connect NULL Pointer Dereference
Same weakness: CWE-78
-
CVE-2026-102294
Authenticated OS Command Injection in TL-WR841N IPv6 WAN Con -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in -
CVE-2026-12542
Foreman: command injection in foreman-tail -
CVE-2026-12541
Foreman: command injection in foreman-rake database tasks -
CVE-2026-12540
Foreman: command injection in foreman-rake errors:fetch_log
V. Comments for CVE-2026-84682
No comments yet