CVE-2026-102815
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface; a local attacker with access to a low-privileged process may submit a crafted request to the TDDPv1 service and execute OS commands with root privileges.
Risk Assessment
A local low-privileged attacker may obtain root privileges and execute arbitrary operating-system commands on the affected device, leading to full device compromise.
Recommendation
Update TP-Link RE305 V3 firmware to the patched version and limit the ability to run untrusted local processes on the device.
Other vulnerabilities in TP-Link RE305 V3
See all- CVE-2026-102816Medium
An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration.
- CVE-2026-102813Medium
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code; the lack of an effective attempt counter or lockout and a predictable code generation process may allow obtaining or brute-forcing the code.
Original NVD description (English source)
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the TDDPv1 service and execute operating-system commands with root privileges. Successful exploitation may allow a local attacker with low privileges to obtain root privileges and execute arbitrary operating-system commands on the affected device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS