CVE-2026-102815: Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the TDDPv1 service and execute operating-system commands with root privileges.
Successful exploitation may allow a local attacker with low privileges to obtain root privileges and execute arbitrary operating-system commands on the affected device.
Affected Software
Event History
Frequently Asked Questions
Is this reachable by an attacker from the network?
The affected service listens only on the local loopback interface. Exploitation requires local access to a low-privileged process on the device, rather than direct access over the network.
What level of access is needed before exploitation?
An attacker needs access to a low-privileged process on the affected device and must be able to submit a crafted request to the TDDPv1 service. Successful exploitation can elevate that local access to root.
What is the impact after successful exploitation?
Because tmpServer runs with root privileges, a successful attacker can execute arbitrary operating-system commands as root and obtain full administrative control of the device.