CVE-2026-0834

Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability. This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419 Archer AX53 v1.0 < V1_251215 TL-WR841N v13 < 0.9.1 Build 20231120 Rel.62366

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://mattg.systems/posts/cve-2026-0834/	Permissions Required
https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware	Product
https://www.tp-link.com/en/support/download/archer-c20/v5/#Firmware
https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware	Product
https://www.tp-link.com/us/support/download/archer-c20/v5/#Firmware
https://www.tp-link.com/us/support/download/tl-wr841n/v13/#Firmware
https://www.tp-link.com/us/support/faq/4905/

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:archer_ax53:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:tp-link:archer_c20_firmware:6.0:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:archer_c20:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-21 18:16

Updated : 2026-06-17 10:11

NVD link : CVE-2026-0834

Mitre link : CVE-2026-0834

CVE.ORG link : CVE-2026-0834

JSON object : View

Products Affected

tp-link

archer_ax53_firmware
archer_c20
archer_c20_firmware
archer_ax53

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-0834", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0834", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T04:55:49.767529Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "modules": ["tddp"], "product": "Archer C20 v6.0, Archer AX53 v1.0", "versions": [{"status": "affected", "version": "0", "lessThan": "V6_251031", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "V1_251215", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "modules": ["tddp"], "product": "Archer C20 V5", "versions": [{"status": "affected", "version": "0", "lessThan": "US_V5_260419", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "EU_V5_260317", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP Link Systems Inc.", "product": "TL-WR841N v13", "versions": [{"status": "affected", "version": "0", "lessThan": "0.9.1 Build 20231120 Rel.62366", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-21T18:16:24.773", "references": [{"url": "https://mattg.systems/posts/cve-2026-0834/", "tags": ["Permissions Required"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/en/support/download/archer-c20/v5/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/archer-c20/v5/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/tl-wr841n/v13/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/4905/", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials.\u00a0Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.\n\nThis issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or <\u00a0US_V5_260419\n\n\nArcher AX53 v1.0 < \n\nV1_251215\n\n\n\nTL-WR841N v13 <\u00a00.9.1 Build 20231120 Rel.62366"}, {"lang": "es", "value": "Vulnerabilidad l\u00f3gica en TP-Link Archer C20 v6.0 y Archer AX53 v1.0 (m\u00f3dulo TDDP) permite a atacantes adyacentes no autenticados ejecutar comandos administrativos incluyendo restablecimiento de f\u00e1brica y reinicio del dispositivo sin credenciales. Atacantes en la red adyacente pueden activar de forma remota restablecimientos de f\u00e1brica y reinicios sin credenciales, causando p\u00e9rdida de configuraci\u00f3n e interrupci\u00f3n de la disponibilidad del dispositivo. Este problema afecta a Archer C20 v6.0 < V6_251031.\n\nArcher AX53 v1.0 < V1_251215"}], "lastModified": "2026-06-17T10:11:27.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C762E60-933C-4B61-84D1-0A6FE4D5E08E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_ax53:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "394AAF99-8784-4872-8EED-A12B97C575E4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_c20_firmware:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E36B6485-1C16-4FC9-B5ED-3B0D5FC9B16B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_c20:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4FFFAF05-D4CE-454A-B830-7899CAFC8ED0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}