Vulnerability · Published Oct 27, 2026 · Assigned by TPLink
CVE-2026-102814Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305
High 8.7
In plain English
A high-severity OS command injection in RE305 v3 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionality that can lead to operating-system command execution when the TDDP service is running and accessible. Successful exploitation may allow an unauthenticated attacker on the same local area network to execute arbitrary system commands with root privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | RE305 v3 | 0 – before 1.1.8 Build 20260921 Rel. 42853 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N