{"id":"CVE-2026-102815","title":"Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305","summary":"An\noperating-system command injection vulnerability exists in the tmpServer\nservice of TP-Link RE305 V3. The service runs with root privileges and listens\non the local loopback interface. A local attacker with access to a\nlow-privileged …","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-78"],"vendor":"TP-Link Systems Inc.","product":"RE305 v3","affected":["re305_v3 < 1.1.8 Build 20260921 Rel. 42853"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-29T03:56:30.954645Z"},"published":"2026-10-27","updated":"2026-10-29","sourceUpdated":"2026-10-29T10:45:45.539Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102815","references":[{"url":"https://www.tp-link.com/us/support/download/re305/v3/#Firmware"},{"url":"https://www.tp-link.com/en/support/download/re305/v3/#Firmware"},{"url":"https://www.tp-link.com/us/support/faq/5362/"}],"tags":["cve.org"],"epss":0.00598,"epssPercentile":0.48602,"ingestedAt":"2026-10-27T17:54:31.779Z","slug":"CVE-2026-102815","body":"## Overview\n\nAn\noperating-system command injection vulnerability exists in the tmpServer\nservice of TP-Link RE305 V3. The service runs with root privileges and listens\non the local loopback interface. A local attacker with access to a\nlow-privileged process on the device may submit a crafted request to the TDDPv1\nservice and execute operating-system commands with root privileges.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow a local attacker with low privileges to obtain root\nprivileges and execute arbitrary operating-system commands on the affected\ndevice.\n\n## Affected\n\n- `re305_v3 < 1.1.8 Build 20260921 Rel. 42853`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}