Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

TP-Link RE305 allows local attacker to gain root access

CVE-2026-102815 · published 8 days ago
Summary

The RE305 V3 router runs a service called tmpServer with full system rights. An attacker who can run a low‑level program on the router could send a specially crafted request to that service and make it run any command as the administrator. To protect the device, update the firmware to the latest version or disable any unnecessary local services.

What to do
  • Update tp-link systems inc. re305 v3 to version 1.1.8 Build 20260921 Rel. 42853 or later.
Affected software
VendorProductAffected versions
tp-link systems inc. re305 v3 < 1.1.8 Build 20260921 Rel. 42853
Original advisory text
Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305
An
operating-system command injection vulnerability exists in the tmpServer
service of TP-Link RE305 V3. The service runs with root privileges and listens
on the local loopback interface. A local attacker with access to a
low-privileged process on the device may submit a crafted request to the TDDPv1
service and execute operating-system commands with root privileges.









Successful
exploitation may allow a local attacker with low privileges to obtain root
privileges and execute arbitrary operating-system commands on the affected
device.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published27 Oct 2026
Updated4 Nov 2026
First seen27 Oct 2026
Sources
CVE-2026-102815 · NVD
CVE-2026-102815 · MITRE
Track software like this
Free during beta