6.9
MediumCVSS 4.0 · from TPLink
CVE-2026-102815
Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305
RE305 v3 · OS command injection · CWE-78AffectedRE305 v3
FixUpdate to 1.1.8 Build 20260921 Rel. 42853 or newer
PublishedOct 27, 17:40 · TPLink
ScoredOct 27 · 6.9 · TPLink
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
A successful attack can change data. CVSS impact.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the TDDPv1 service and execute operating-system commands with root privileges. Successful exploitation may allow a local attacker with low privileges to obtain root privileges and execute arbitrary operating-system commands on the affected device.
From TPLink
Affected and fixed versions
ProductAffectedFixed inRE305 v3before 1.1.8 Build 20260921 Rel. 428531.1.8 Build 20260921 Rel. 42853
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known