{"id":"CVE-2026-84682","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-84682","generatedAt":"2026-10-27T23:56:57.829Z","title":"A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1.","description":"A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. \n\nSuccessful exploitation may result in complete device compromise through arbitrary command execution with root privileges.","published":"2026-10-01T19:17:25.000Z","lastModified":"2026-10-23T17:17:22.000Z","status":"Deferred","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","cvss":{"version":"4.0","score":7.7,"severity":"HIGH","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-78"],"affected":[],"epss":{"score":0.01207,"percentile":0.68136,"date":"2026-10-26","history":[{"date":"2026-10-02","score":0.01042,"percentile":0.62821}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-01T19:17:25.000Z","detail":{"score":"7.7","severity":"HIGH","publishedAt":"2026-10-01T19:17:24.960Z"},"summary":"New CVE, high severity (CVSS 7.7)."}],"references":[{"url":"https://www.tp-link.com/en/support/download/archer-ax90/v1/#Firmware","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/archer-ax90/v1/#Firmware","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5323/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-84682","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}