---
id: CVE-2026-102814
title: >-
  Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in
  TP-Link RE305
summary: |-
  An
  authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305
  V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an
  unauthenticated attacker on the same local network to forge protocol packets
  a…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-78
vendor: TP-Link Systems Inc.
product: RE305 v3
affected:
  - re305_v3 < 1.1.8 Build 20260921 Rel. 42853
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-29T03:56:34.566618Z'
published: '2026-10-27'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:45:45.682Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-102814'
references:
  - url: 'https://www.tp-link.com/us/support/download/re305/v3/#Firmware'
  - url: 'https://www.tp-link.com/en/support/download/re305/v3/#Firmware'
  - url: 'https://www.tp-link.com/us/support/faq/5362/'
tags:
  - cve.org
epss: 0.0036
epssPercentile: 0.29903
ingestedAt: '2026-10-27T17:54:31.783Z'
---

## Overview

An
authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305
V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an
unauthenticated attacker on the same local network to forge protocol packets
and access privileged TDDP operations, including functionality that can lead to
operating-system command execution when the TDDP service is running and
accessible.









Successful
exploitation may allow an unauthenticated attacker on the same local area
network to execute arbitrary system commands with root privileges.

## Affected

- `re305_v3 < 1.1.8 Build 20260921 Rel. 42853`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.