CVE-2026-0834

highpriority · attend · 45EPSS 0.004 · 37 %ileexploit · PoCEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.43% (37th) EPSS

CVSS 8.8 · high

Is it mine?

28 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_it

EPSS · scored 2026-10-27

Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability. This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419 Archer AX53 v1.0 < V1_251215 TL-WR841N v13 < 0.9.1 Build 20231120 Rel.62366

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedArcher AX53 v1.0cisa_csaf_it
Fixed in V1_251215.
https://www.tp-link.com/us/support/faq/4905/
FixedArcher C20 V5cisa_csaf_it
Fixed in EU_V5_260317.
https://www.tp-link.com/us/support/faq/4905/
FixedArcher C20 v6.0cisa_csaf_it
Fixed in V6_251031.
https://www.tp-link.com/us/support/faq/4905/
FixedTL-WR841N v13cisa_csaf_it
Fixed in 0.9.1 Build 20231120 Rel.62366.
https://www.tp-link.com/us/support/faq/4905/

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.7–8.8

v3.18.8highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.3highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Hsecondary · CISA US

v3.18.3highAV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Hsecondary · FSTEC (BDU) RU

v4.07.2highCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.07.2highCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary

v4.05.7mediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-290USCWE-290USCWE-290US

exploits (1)

Public proof-of-concept and weaponised exploit code.

mattgsys/CVE-2026-0834Proof of Concept (PoC) for the TP-Link Device Debug Protocol (TDDP) Authentication Bypass (CVE-2026-0834)PoC · poc_in_github

affected products (28)

Products and version ranges known to be affected.

TP-Link Systems Inc. Archer AX53 v1.0 <V1_251215all versionscisa_csaf_itUS
TP-Link Systems Inc. Archer AX53 v1.0 V1_251215all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. Archer C20 V5 <EU_V5_260317all versionscisa_csaf_itUS
TP-Link Systems Inc. Archer C20 V5 <US_V5_260419all versionscisa_csaf_itUS
TP-Link Systems Inc. Archer C20 V5 EU_V5_260317all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. Archer C20 V5 US_V5_260419all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. Archer C20 v6.0 <V6_251031all versionscisa_csaf_itUS
TP-Link Systems Inc. Archer C20 v6.0 V6_251031all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. TL-WR841N v13 0.9.1 Build 20231120 Rel.62366all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. TL-WR841N v13 <0.9.1 Build 20231120 Rel.62366all versionscisa_csaf_itUS
TP-Link Systems Inc. Archer AX53 v1.0all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. Archer AX53 v1.0< V1_251215cisa_csaf_itUS
TP-Link Systems Inc. Archer C20 V5all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. Archer C20 V5< EU_V5_260317cisa_csaf_itUS
TP-Link Systems Inc. Archer C20 V5< US_V5_260419cisa_csaf_itUS
TP-Link Systems Inc. Archer C20 v6.0all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. Archer C20 v6.0< V6_251031cisa_csaf_itUS
TP-Link Systems Inc. TL-WR841N v13all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. TL-WR841N v13< 0.9.1 Build 20231120 Rel.62366cisa_csaf_itUS
Archer C20 V50 → EU_V5_260317enisa_euvdEU

showing 20 of 28

advisories (1)

Vendor and ecosystem advisories describing this.

VA-26-119-02TP-Link WR841N Router multiple vulnerabilities2026-04-29csaf · cisa_csaf_itUS
Multiple TP-Link products (TP-Link Archer C20 V5, Archer C20 6.0, Archer AX53 v1.0 and TL-WR841N v13) are affected by multiple vulnerabilities. The most severe of these vulnerabilities could allow an adjacent, unauthenticated attacker to execute administrative commands.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_it NVD CVE.org MITRE

published 2026-01-21modified 2026-06-17

references (18)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan