CVE-2026-84682CWE-78command-injection

CVE-2026-84682

published October 1, 2026

CVSS
7.7
EPSS
1%
Percentile
63.8
In the wild
Unconfirmed
What it is

A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot.

Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.

The record
Technical detail
CVSS
7.7 · NONE
CVSS v4.0
7.7 · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.01042 · 63.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-01T23:17Z
References (3)
https://www.tp-link.com/en/support/download/archer-ax90/v1/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/download/archer-ax90/v1/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/faq/5323/ · f23511db-6c3e-4e32-a477-6aa17d310630
EPSS history
Timeline
  • 03 OCT 03:46Z
    EPSS moved — → 1%
    epss
  • 01 OCT 18:48Z
    TDDPv2 setProductVer Command Injection in Archer AX90
    cvelistv5