CVE-2026-84682: TDDPv2 setProductVer Command Injection in Archer AX90
Published Oct 1, 2026
·Updated
A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot.
Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.
Affected Software
1 affected component
TP-Link Archer AX90=V1
Event History
Oct 1, 2026
CVE Published
via MITRE·06:48 PM
Data Sourced
via MITRE·06:48 PM
DescriptionWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Where should administrators check for firmware updates and vendor guidance?
TP-Link provides Archer AX90 V1 firmware download pages for both US and global support regions, along with support FAQ 5323.