CVE-2026-102814
Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305
Using RE305 v3 by TP-Link Systems Inc.?
Get instant alerts when new vulnerabilities affect RE305 v3 - before attackers find them.
Description
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionality that can lead to operating-system command execution when the TDDP service is running and accessible. Successful exploitation may allow an unauthenticated attacker on the same local area network to execute arbitrary system commands with root privileges.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (3)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.