Which versions of TP-Link are affected by CVE-2026-0834?

Organizations using TP-Link Archer C20 face significant risk from CVE-2026-0834 rated CVSS 8.8.

TP-Link CVE-2026-0834

Q: What is the CVSS score of CVE-2026-0834?

CVE-2026-0834 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: How to fix or mitigate CVE-2026-0834?

Within 7 days: Identify all affected systems running TP-Link Archer C20 and apply vendor patches promptly. Monitor vendor channels for patch availability.

HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-01-21 f23511db-6c3e-4e32-a477-6aa17d310630

Authentication Bypass TP-Link

7.2

CVSS 4.0

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Apr 22, 2026 - 22:22 NVD

8.8 (HIGH) 7.2 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 21, 2026 - 18:16 nvd

HIGH 8.8

DescriptionNVD

Logic vulnerability in TP-Link Archer C20 v6.0 and Archer AX53 v1.0 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.This issue affects Archer C20 v6.0 < V6_251031.

Archer AX53 v1.0 <

V1_251215

AnalysisAI

Unauthenticated adjacent network attackers can exploit a logic vulnerability in the TDDP module of TP-Link Archer C20 v6.0 and Archer AX53 v1.0 to execute administrative commands such as factory reset and device reboot without credentials. This allows attackers to cause loss of device configuration and service disruption on vulnerable routers. …

RemediationAI

Within 7 days: Identify all affected systems running TP-Link Archer C20 and apply vendor patches promptly. Monitor vendor channels for patch availability.

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory