High severityNVD Advisory· Published Oct 1, 2026· Updated Oct 1, 2026
CVE-2026-84682
CVE-2026-84682
Description
A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot.
Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.
Affected products
1- Range: V1
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.