CVE-2026-102814: Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionality that can lead to operating-system command execution when the TDDP service is running and accessible.
Successful exploitation may allow an unauthenticated attacker on the same local area network to execute arbitrary system commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An unauthenticated attacker must be on the same local area network as a TP-Link RE305 V3 and able to reach its TDDP v2 service while it is running and accessible. Internet-only attackers are not identified in the available information.
What level of access could exploitation provide?
Successful exploitation may let the attacker execute arbitrary operating-system commands with root privileges on the affected device.
What should be checked during triage?
Confirm that the device is a TP-Link RE305 V3, determine whether the TDDP v2 service is running and reachable from the local network, and review the vendor firmware download and support information referenced for the device.