Archer Ax90 V1
Monthly
Command injection in the TDDPv2 service (/usr/bin/tddp) on TP-Link Archer AX90 V1 routers allows an unauthenticated attacker who is already positioned on the same adjacent network layer - wired LAN, Wi-Fi, or guest network - to inject operating system commands through the setProductVer command handler, which then run as root. The injected payload is executed during device boot, so the attacker must wait for or induce a reboot, and the device is not exploitable over the internet; a fixed firmware release is available from the vendor. Analysis found no public exploit code (no public exploit identified at time of analysis) and the issue is not in CISA KEV, so this is assessed as a credible but above-average-priority fleet risk rather than an internet-wide emergency.
Command injection in the TDDPv2 service (/usr/bin/tddp) on TP-Link Archer AX90 V1 routers allows an unauthenticated attacker who is already positioned on the same adjacent network layer - wired LAN, Wi-Fi, or guest network - to inject operating system commands through the setProductVer command handler, which then run as root. The injected payload is executed during device boot, so the attacker must wait for or induce a reboot, and the device is not exploitable over the internet; a fixed firmware release is available from the vendor. Analysis found no public exploit code (no public exploit identified at time of analysis) and the issue is not in CISA KEV, so this is assessed as a credible but above-average-priority fleet risk rather than an internet-wide emergency.