CVE-2026-0834

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-0834
Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability. This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419 Archer AX53 v1.0 < V1_251215 TL-WR841N v13 < 0.9.1 Build 20231120 Rel.62366

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://mattg.systems/posts/cve-2026-0834/ Permissions Required
https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware Product
https://www.tp-link.com/en/support/download/archer-c20/v5/#Firmware
https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware Product
https://www.tp-link.com/us/support/download/archer-c20/v5/#Firmware
https://www.tp-link.com/us/support/download/tl-wr841n/v13/#Firmware
https://www.tp-link.com/us/support/faq/4905/
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:archer_ax53:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:tp-link:archer_c20_firmware:6.0:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:archer_c20:-:*:*:*:*:*:*:*
History

28 Apr 2026, 19:36

Type Values Removed Values Added
Summary (en) Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419 Archer AX53 v1.0 < V1_251215 TL-WR841N v13 < 0.9.1 Build 20231120 Rel.62366 (en) Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability. This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419 Archer AX53 v1.0 < V1_251215 TL-WR841N v13 < 0.9.1 Build 20231120 Rel.62366

23 Apr 2026, 18:16

Type Values Removed Values Added
Summary (en) Logic vulnerability in TP-Link Archer C20 v6.0 and Archer AX53 v1.0 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419 Archer AX53 v1.0 < V1_251215 (en) Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419 Archer AX53 v1.0 < V1_251215 TL-WR841N v13 < 0.9.1 Build 20231120 Rel.62366
References
  • () https://www.tp-link.com/us/support/download/tl-wr841n/v13/#Firmware -

22 Apr 2026, 22:16

Type Values Removed Values Added
References
  • () https://www.tp-link.com/en/support/download/archer-c20/v5/#Firmware -
  • () https://www.tp-link.com/us/support/download/archer-c20/v5/#Firmware -
  • () https://www.tp-link.com/us/support/faq/4905/ -
Summary
  • (es) Vulnerabilidad lógica en TP-Link Archer C20 v6.0 y Archer AX53 v1.0 (módulo TDDP) permite a atacantes adyacentes no autenticados ejecutar comandos administrativos incluyendo restablecimiento de fábrica y reinicio del dispositivo sin credenciales. Atacantes en la red adyacente pueden activar de forma remota restablecimientos de fábrica y reinicios sin credenciales, causando pérdida de configuración e interrupción de la disponibilidad del dispositivo. Este problema afecta a Archer C20 v6.0 &lt; V6_251031. Archer AX53 v1.0 &lt; V1_251215
Summary (en) Logic vulnerability in TP-Link Archer C20 v6.0 and Archer AX53 v1.0 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.This issue affects Archer C20 v6.0 < V6_251031. Archer AX53 v1.0 < V1_251215 (en) Logic vulnerability in TP-Link Archer C20 v6.0 and Archer AX53 v1.0 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419 Archer AX53 v1.0 < V1_251215

10 Feb 2026, 16:34

Type Values Removed Values Added
CPE cpe:2.3:o:tp-link:archer_c20_firmware:6.0:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:archer_c20:-:*:*:*:*:*:*:*
cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:archer_ax53:-:*:*:*:*:*:*:*
First Time Tp-link
Tp-link archer C20
Tp-link archer Ax53
Tp-link archer Ax53 Firmware
Tp-link archer C20 Firmware
References () https://mattg.systems/posts/cve-2026-0834/ - () https://mattg.systems/posts/cve-2026-0834/ - Permissions Required
References () https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware - () https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware - Product
References () https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware - () https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware - Product
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

21 Jan 2026, 20:16

Type Values Removed Values Added
References
  • {'url': 'https://killing.systems/posts/cve-2026-0834/', 'source': 'f23511db-6c3e-4e32-a477-6aa17d310630'}
  • () https://mattg.systems/posts/cve-2026-0834/ -

21 Jan 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-21 18:16

Updated : 2026-04-28 19:36

NVD link : CVE-2026-0834

Mitre link : CVE-2026-0834

CVE.ORG link : CVE-2026-0834

JSON object : View

Products Affected

tp-link

  • archer_ax53
  • archer_c20
  • archer_c20_firmware
  • archer_ax53_firmware
CWE
CWE-290

Authentication Bypass by Spoofing