TP-Link RE305 EUVD-2026-111273

Requires the TP-Link TDDP v2 service to be running and reachable, and the attacker must be on the same local area network (CVSS AV:A, adjacent) as the RE305 V3 device. The core weakness is that TDDP v2 uses a fixed and derivable cryptographic key, letting an unauthenticated attacker (PR:N) forge valid protocol packets without credentials or user interaction. Exploitation is limited to attackers with local/adjacent network presence - it is not exploitable from the internet - and affects RE305 V3 firmware before 1.1.8 Build 20260921 Rel. 42853; updating to that firmware is the vendor-provided fix.

This is a genuine high-priority issue rather than an inflated CVSS score, but its reach is bounded by the attack vector. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent-network, low-complexity, unauthenticated attack with no user interaction and high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H), consistent with the stated outcome of root-level OS command execution via CWE-78. The constraining signal is AV:A: exploitation requires the attacker to already be on the same local network, so this is not a remotely internet-exploitable flaw and cannot be automated at internet scale against arbitrary targets. No EPSS score, CISA KEV listing, or exploit/PoC reference is present in the supplied data, so there is no evidence of active exploitation; the vuln.today decision label is 'this_week' rather than act_now/emergency. Net: on a device an attacker can already reach on the LAN, impact is severe (root), but the adjacency requirement and absence of exploitation signals place this below internet-facing critical vulnerabilities.

An attacker who has joined the same local network as a vulnerable RE305 V3 range extender (for example via the extended Wi-Fi) derives the fixed TDDP v2 cryptographic key and forges valid TDDP protocol packets to the running service. Those forged packets invoke privileged TDDP operations that reach OS command execution, giving the attacker arbitrary system commands as root on the device. No public exploit identified at time of analysis.