EUVD-2026-111274
GHSA-x9gf-gx28-57pq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged process on device
-
DeliveryCraft malicious TDDPv1 request
-
ExploitSubmit to loopback tmpServer service
-
ExecutionInject OS command (CWE-78)
-
ImpactExecute arbitrary commands as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a low-privileged process already running on a TP-Link RE305 V3 extender, because the vulnerable tmpServer/TDDPv1 service listens only on the local loopback interface and is therefore not reachable over the network. The crafted request is submitted to the root-privileged TDDPv1 service to achieve the command injection. Limiting factors: the attacker must first obtain an on-device foothold (PR:L), there is no remote/network path and no cross-device scope change, and devices updated to firmware 1.1.8 Build 20260921 Rel. 42853 or later are not affected. |
| Impact | Signals point to a moderate, situational priority rather than a top-tier emergency. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and score of 6.9 describe a local, low-complexity, low-privilege privilege-escalation issue, not a remotely reachable flaw - the tmpServer/TDDPv1 service listens only on the local loopback interface, so an attacker must already hold a low-privileged foothold on the device. The vuln.today Decision label is 'this_month' (not act_now/emergency), consistent with the local vector. No EPSS probability was provided, the CVE is not listed in CISA KEV, and no PoC or exploit reference appears in the input, so there is no confirmed or probable active-exploitation signal. The main caveat is a signal gap rather than a conflict: EPSS is missing and KEV/PoC are absent, so exploitation likelihood cannot be quantified from the data given. Net: a credible root-level local escalation worth patching on a normal cycle, more important on devices where untrusted or low-privileged code can run, but not a drop-everything network-exploitable bug. |
| Exploit ScenarioDerived | An attacker who has already achieved low-privileged code execution on an RE305 V3 extender (for example via another flaw or a malicious process) submits a crafted request to the root-owned TDDPv1/tmpServer service on the loopback interface. The injected operating-system command then runs with root privileges, giving full control of the device. No public exploit identified at time of analysis, so this reflects the described mechanism rather than a weaponized PoC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
OS command injection in the tmpServer/TDDPv1 service of the TP-Link RE305 V3 range extender lets a low-privileged local attacker run arbitrary operating-system commands as root on the device. The service listens only on the local loopback interface, so the attacker must already hold some on-device execution foothold; there is no network-reachable path and no scope change beyond the extender itself. No public exploit code was identified at time of analysis, and TP-Link has released firmware 1.1.8 Build 20260921 Rel. 42853 that removes the flaw, making this a moderate, situational priority (patching this month) rather than an emergency.
RemediationAI
Vendor-released patch: update the RE305 V3 to firmware 1.1.8 Build 20260921 Rel. 42853 or later, available from the TP-Link download page for hardware v3 (https://www.tp-link.com/us/support/download/re305/v3/#Firmware or https://www.tp-link.com/en/support/download/re305/v3/#Firmware), with details in TP-Link FAQ 5362 (https://www.tp-link.com/us/support/faq/5362/). Updating is the complete fix; because the vulnerable tmpServer/TDDPv1 daemon is bound to loopback only, exposure depends entirely on an attacker first obtaining a low-privileged foothold on the extender, so until the upgrade is applied the practical reduction in risk comes from shrinking that foothold surface - keeping administrative credentials strong and unique, and avoiding unnecessary exposure of the device's management interfaces - which lowers the likelihood of the required local access but does not remediate the command injection itself. No workaround that disables or firewalls the loopback-only service is documented in the supplied sources.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is tmpServer, the daemon implementing TDDPv1 (TP-Link Device Debug Protocol), which runs with root privileges and binds only to the loopback interface on the RE305 V3. The flaw is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning attacker-influenced input from a crafted TDDPv1 request reaches command execution without adequate sanitization, yielding root-level command execution in the context of the daemon. Because the listener is loopback-only, the vulnerability is not exposed to the WAN, LAN, or an unauthenticated network client; the assessment records local access to an already-running low-privileged process as the precondition (CVSS 4.0 AV:L/PR:L, assessed 3.1 AV:L/AC:L/PR:L/UI:N). The specific request field and parsing path that carries the injected payload are not described in the available sources, so the precise trigger mechanics remain unverified from public data. Devices running firmware 1.1.8 Build 20260921 Rel. 42853 or later are not affected.
Know when Re305 V3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Local foothold with low privileges and no user interaction (AV:L/AC:L/PR:L/UI:N); command execution as root yields full device compromise, so C:H/I:H/A:H.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
DescriptionCVE.org
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the TDDPv1 service and execute operating-system commands with root privileges.
Successful exploitation may allow a local attacker with low privileges to obtain root privileges and execute arbitrary operating-system commands on the affected device.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Authentication bypass in the TDDP v2 service of the TP-Link RE305 V3 range extender lets an unauthenticated attacker on
Hard-coded AES-128 key and IV values in TP-Link RE305 V3 and Archer C7 V5 configuration backups allow anyone who obtains
Administrator account takeover in TP-Link RE305 V3 Wi-Fi range extenders: the device's unauthenticated password-recovery
The country/region configuration interface of the TP-Link RE305 V3 range extender lacks an authorization check, so anyon
Exploit-DB