CVE-2026-0834

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0834", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-01-09T21:48:53.385Z", "datePublished": "2026-01-21T17:14:55.179Z", "dateUpdated": "2026-04-28T17:46:59.608Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-04-28T17:46:59.608Z"}, "title": "Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Archer C20 v6.0, Archer AX53 v1.0", "modules": ["tddp"], "versions": [{"status": "affected", "version": "0", "lessThan": "V6_251031", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "V1_251215", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer C20 V5", "modules": ["tddp"], "versions": [{"status": "affected", "version": "0", "lessThan": "US_V5_260419", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "EU_V5_260317", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP Link Systems Inc.", "product": "TL-WR841N v13", "versions": [{"status": "affected", "version": "0", "lessThan": "0.9.1 Build 20231120 Rel.62366", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials.\u00a0Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.\n\nThis issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or <\u00a0US_V5_260419\n\n\nArcher AX53 v1.0 < \n\nV1_251215\n\n\n\nTL-WR841N v13 <\u00a00.9.1 Build 20231120 Rel.62366", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Logic vulnerability <span>in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (</span>TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials.&nbsp;Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.<p>This issue affects Archer C20 v6.0 &lt; V6_251031, Archer C20 v5 &lt;EU_V5_260317 or &lt;&nbsp;US_V5_260419<br>\n\nArcher AX53 v1.0 &lt; \n\nV1_251215</p><p><span>TL-WR841N v13 &lt;&nbsp;</span><span>0.9.1 Build 20231120 Rel.62366</span></p>"}]}], "references": [{"url": "https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware", "tags": ["patch"]}, {"url": "https://mattg.systems/posts/cve-2026-0834/"}, {"url": "https://www.tp-link.com/us/support/faq/4905/", "tags": ["vendor-advisory"]}, {"url": "https://www.tp-link.com/us/support/download/archer-c20/v5/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-c20/v5/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/download/tl-wr841n/v13/#Firmware", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Matt Graham (mattg.systems)", "type": "finder"}, {"lang": "en", "value": "Ben Grinberg, Adiel Sol, Daniel Lubel, Erez Cohen, Nir Somech, Arad Inbar, Dream Group", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0834", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T04:55:49.767529Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:34.299Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0834", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T04:55:49.767529Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T18:36:14.293Z"}}], "cna": {"title": "Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Matt Graham (mattg.systems)"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "modules": ["tddp"], "product": "Archer C20 v6.0, Archer AX53 v1.0", "versions": [{"status": "affected", "version": "0", "lessThan": "V6_251031", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "V1_251215", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "modules": ["tddp"], "product": "Archer C20 V5", "versions": [{"status": "affected", "version": "0", "lessThan": "US_V5_260419", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "EU_V5_260317", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP Link Systems Inc.", "product": "TL-WR841N v13", "versions": [{"status": "affected", "version": "0", "lessThan": "0.9.1 Build 20231120 Rel.62366", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware", "tags": ["patch"]}, {"url": "https://mattg.systems/posts/cve-2026-0834/"}, {"url": "https://www.tp-link.com/us/support/faq/4905/", "tags": ["vendor-advisory"]}, {"url": "https://www.tp-link.com/us/support/download/archer-c20/v5/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-c20/v5/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/download/tl-wr841n/v13/#Firmware", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials.\u00a0Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or <\u00a0US_V5_260419\n\n\nArcher AX53 v1.0 < \n\nV1_251215\n\nTL-WR841N v13 <\u00a00.9.1 Build 20231120 Rel.62366", "supportingMedia": [{"type": "text/html", "value": "Logic vulnerability <span>in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (</span>TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials.&nbsp;Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.<p>This issue affects Archer C20 v6.0 &lt; V6_251031, Archer C20 v5 &lt;EU_V5_260317 or &lt;&nbsp;US_V5_260419<br>\n\nArcher AX53 v1.0 &lt; \n\nV1_251215</p><p><span>TL-WR841N v13 &lt;&nbsp;</span><span>0.9.1 Build 20231120 Rel.62366</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-04-23T16:48:27.932Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0834", "state": "PUBLISHED", "dateUpdated": "2026-04-23T16:48:27.932Z", "dateReserved": "2026-01-09T21:48:53.385Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-01-21T17:14:55.179Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["tddp"], "product": "Archer C20 v6.0, Archer AX53 v1.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "V6_251031", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "V1_251215", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["tddp"], "product": "Archer C20 V5", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "US_V5_260419", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "EU_V5_260317", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "TL-WR841N v13", "vendor": "TP Link Systems Inc.", "versions": [{"lessThan": "0.9.1 Build 20231120 Rel.62366", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "8C762E60-933C-4B61-84D1-0A6FE4D5E08E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_ax53:-:*:*:*:*:*:*:*", "matchCriteriaId": "394AAF99-8784-4872-8EED-A12B97C575E4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_c20_firmware:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "E36B6485-1C16-4FC9-B5ED-3B0D5FC9B16B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_c20:-:*:*:*:*:*:*:*", "matchCriteriaId": "4FFFAF05-D4CE-454A-B830-7899CAFC8ED0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials.\u00a0Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.\n\nThis issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or <\u00a0US_V5_260419\n\n\nArcher AX53 v1.0 < \n\nV1_251215\n\n\n\nTL-WR841N v13 <\u00a00.9.1 Build 20231120 Rel.62366"}, {"lang": "es", "value": "Vulnerabilidad l\u00f3gica en TP-Link Archer C20 v6.0 y Archer AX53 v1.0 (m\u00f3dulo TDDP) permite a atacantes adyacentes no autenticados ejecutar comandos administrativos incluyendo restablecimiento de f\u00e1brica y reinicio del dispositivo sin credenciales. Atacantes en la red adyacente pueden activar de forma remota restablecimientos de f\u00e1brica y reinicios sin credenciales, causando p\u00e9rdida de configuraci\u00f3n e interrupci\u00f3n de la disponibilidad del dispositivo. Este problema afecta a Archer C20 v6.0 &lt; V6_251031.\n\nArcher AX53 v1.0 &lt; V1_251215"}], "id": "CVE-2026-0834", "lastModified": "2026-06-17T10:11:27.867", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0834", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T04:55:49.767529Z", "version": "2.0.3"}}]}, "published": "2026-01-21T18:16:24.773", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Permissions Required"], "url": "https://mattg.systems/posts/cve-2026-0834/"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/archer-c20/v5/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/download/archer-c20/v5/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/download/tl-wr841n/v13/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/faq/4905/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-29T00:59:08.666851+00:00", "value": {"mitigation_remediation": ["Apply the latest firmware update from TP\u2011Link for Archer C20 (v6.251031 or later).", "Apply the latest firmware update for Archer AX53 (v1.251215 or later).", "If a firmware update is not immediately available, isolate the router from the local network or disable the TDDP service to prevent unauthenticated access."], "summary": {"action": "Apply Firmware", "impact": "Unauthenticated administrative command execution"}, "threat_synthesis": {"affected_systems": "Affected vendors and products are TP\u2011Link Systems Inc. Archer C20 firmware versions older than v6.251031, older than EU_V5_260317 or US_V5_260419 for the v5 line, and Archer AX53 firmware versions older than v1.251215. These routers are typically used in home and small office environments and expose the TDDP service to neighboring devices.", "description_and_impact": "The vulnerability is a logic flaw in the TDDP module of TP\u2011Link Archer C20, Archer AX53, and TL\u2011WR841N routers, allowing unauthenticated adjacent attackers to trigger administrative actions such as factory reset and device reboot without any credentials. This results in loss of configuration and interruption of device availability. The affected firmware releases include Archer C20 v6.0 firmware older than V6_251031, Archer C20 v5 firmware older than EU_V5_260317 or US_V5_260419, and Archer AX53 v1.0 firmware older than V1_251215.", "risk_and_exploitability": "The vulnerability has a CVSS score of 7.2, indicating high severity. EPSS shows a very low exploitation likelihood (<1%). It is not currently listed in the CISA KEV catalog. Based on the description, the attack vector is an unauthenticated attacker on the adjacent network segment exploiting the TDDP module without credentials, which can force factory resets and reboots, causing a denial of service and loss of configuration on the affected routers."}}}}, "created": "2026-01-22T10:14:52.810861+00:00", "updated": "2026-04-29T01:00:11.420704+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$archer_ax53", "tp-link$PRODUCT$archer_c20"]}