{"id":"CVE-2026-102814","kind":"vulnerability","aliases":["CVE-2026-102814"],"related":[],"title":"TP-Link RE305 V3: TDDP v2 weak key lets local attacker run root commands","description":"An\nauthentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305\nV3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an\nunauthenticated attacker on the same local network to forge protocol packets\nand access privileged TDDP operations, including functionality that can lead to\noperating-system command execution when the TDDP service is running and\naccessible.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker on the same local area\nnetwork to execute arbitrary system commands with root privileges.","summary":"The TP-Link RE305 V3 range extender's TDDP v2 management service uses a fixed, derivable cryptographic key, so forged protocol packets are accepted. An unauthenticated attacker on the same local network can reach privileged TDDP operations and run arbitrary system commands as root.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["home-router","infrastructure","iot","lan","re305-v3","tp-link"],"not_affected_if":["isolated-lan","no-re305-v3","tddp-disabled"],"how_to_check":"- Check the firmware version on the RE305 V3 admin page or with the vendor app and compare it to the fixed release.\n- Confirm whether the TDDP service is reachable from other hosts on the LAN; the sources do not name a port or command to test this.","fix":"- Update the TP-Link RE305 V3 to the firmware the vendor publishes for this issue; the sources do not give a version number, so `unknown`.\n- Until patched, disable or block TDDP reachability on the local network if the device allows it; the sources do not describe a setting, so `unknown`.","status":"open","published_at":"2026-10-27T18:17:30+00:00","first_seen_at":"2026-10-27T18:32:58+00:00","triaged_at":"2026-10-27T18:34:27+00:00","updated_at":"2026-10-27T18:34:27+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-27T18:34:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update the TP-Link RE305 V3 to the firmware the vendor publishes for this issue; the sources do not give a version number, so `unknown`.\n- Until patched, disable or block TDDP reachability on the local network if the device allows it; the sources do not describe a setting, so `unknown`.","reach":"network","title":"TP-Link RE305 V3: TDDP v2 weak key lets local attacker run root commands","impact":"high","summary":"The TP-Link RE305 V3 range extender's TDDP v2 management service uses a fixed, derivable cryptographic key, so forged protocol packets are accepted. An unauthenticated attacker on the same local network can reach privileged TDDP operations and run arbitrary system commands as root.","category":"infrastructure","nicknames":[],"who_cares":["tp-link","re305-v3","home-router","iot","lan"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated LAN attacker runs system commands as root on the extender","analyst_note":"Find the vendor advisory and fixed firmware version for RE305 V3 and whether TDDP is enabled by default; the NVD entry alone does not give these.","how_to_check":"- Check the firmware version on the RE305 V3 admin page or with the vendor app and compare it to the fixed release.\n- Confirm whether the TDDP service is reachable from other hosts on the LAN; the sources do not name a port or command to test this.","needs_analyst":true,"not_affected_if":["no-re305-v3","tddp-disabled","isolated-lan"],"who_is_affected":"Owners of TP-Link RE305 V3 range extenders where the TDDP v2 service is running and reachable from the same local network. The sources do not describe a default-off setting, so assume any network with an exposed device is at risk. Systems that do not run this device or whose LAN does not include an untrusted party can deprioritise it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":3396,"output_tokens":690,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102814':18A,21A '-2026':17A,20A 'accept':58B 'access':122C,144C 'allow':108C,148C 'arbitrari':74B,160C 'area':156C 'attack':12A,61B,111C,151C 'authent':80C 'command':15A,76B,135C,162C 'cryptograph':51B,104C 'cve':16A,19A 'deriv':50B,103C 'execut':136C,159C 'exist':82C 'exploit':146C 'extend':41B 'fix':49B,101C 'forg':54B,118C 'function':127C 'home':23B 'home-rout':22B 'includ':126C 'infrastructur':25B 'iot':26B 'key':9A,52B,105C 'lan':27B 'lead':130C 'let':10A 'link':3A,33B,37B,87C,94C 'local':11A,65B,115C,155C 'manag':45B 'may':107C,147C 'network':66B,116C,157C 'oper':71B,125C,133C 'operating-system':132C 'packet':56B,120C 'privileg':69B,123C,165C 'protocol':55B,119C 'rang':40B 're305':4A,29B,38B,95C 're305-v3':28B 'reach':68B 'root':14A,78B,164C 'router':24B 'run':13A,73B,142C 'servic':46B,90C,140C 'success':145C 'system':75B,134C,161C 'tddp':6A,43B,70B,88C,97C,124C,139C 'tp':2A,32B,36B,86C,93C 'tp-link':1A,31B,35B,85C,92C 'unauthent':60B,110C,150C 'use':47B,99C 'v2':7A,44B,89C,98C 'v3':5A,30B,39B,96C 'weak':8A,81C","nicknames":[],"mitigations":[],"who_affected":"Owners of TP-Link RE305 V3 range extenders where the TDDP v2 service is running and reachable from the same local network. The sources do not describe a default-off setting, so assume any network with an exposed device is at risk. Systems that do not run this device or whose LAN does not include an untrusted party can deprioritise it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102814","severity":null,"published_at":"2026-10-27T18:17:30+00:00","modified_at":"2026-10-27T18:17:30+00:00","first_seen_at":"2026-10-27T18:32:58+00:00","fetched_at":"2026-10-27T18:32:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}