Archer AX90 EUVD-2026-91040

The attacker must occupy an adjacent-network position (same L2 segment - wired LAN, Wi-Fi including guest networks, or wireless range) to reach the TDDPv2 service (/usr/bin/tddp) on the Archer AX90 V1; no authentication is required (PR:N). Exploitation targets the setProductVer command handler to inject OS commands, but the injected command executes as root during device boot - so a reboot must occur or be induced for the payload to run (the AT:P attack requirement). Principal limiting factors: adjacent-network access only (not internet-exploitable), the boot-timing dependency, and applicability restricted to Archer AX90 V1; a fixed firmware release is available from the vendor.

This is a credible, above-average-priority issue for affected fleets, but not an internet-wide emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N) confirms an unauthenticated (PR:N) attacker limited to the adjacent network (AV:A) - i.e. the same LAN/Wi-Fi/L2 segment, NOT remote internet access - and the AT:P attack requirement reflects a real timing dependency: the injected command executes during device boot, so exploitation hinges on a reboot occurring. Technical impact is severe (VC:H/VI:H/VA:H, command execution as root = full device compromise), with modest spillover to subsequent systems (SC:L/SI:L/SA:L), consistent with a compromised router pivoting onto the LAN. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization; the realistic signal is 'high-impact but access- and timing-constrained.' Compared across signals: impact is high, but the adjacent-network precondition plus the boot-timing requirement materially lower real-world exploitability versus a true network-facing RCE. A vendor patch is available, which is the decisive mitigating factor. Key missing data to note: no EPSS, no KEV, no POC status, and the SSVC/automatable determination is not provided.

An attacker who has gained a foothold on the local network (e.g. a guest Wi-Fi client, a compromised IoT device, or someone within wireless range) sends a crafted setProductVer request to the TDDPv2 service (/usr/bin/tddp) on an Archer AX90 V1. The injected OS command is stored and executed with root privileges during the next device boot, yielding full control of the router. No public exploit code was identified at time of analysis, and successful execution depends on a reboot occurring.