Vulnerability · Published Oct 1, 2026 · Assigned by TPLink

CVE-2026-84682TDDPv2 setProductVer Command Injection in Archer AX90

High 7.7

In plain English

A high-severity OS command injection in Archer AX90 v1 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)1.2%top 31.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	Archer AX90 v1	0 – before 1.1.14 Build 20260927

Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

In plain English

Official description

Affected products (as reported)

References