TI-2026-00615 Aliases CVE-2026-0834 GHSA-cpr3-8r3m-jjf4

Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13

HIGH 67CWE-290Published 2026-01-21 · Updated 2026-04-28

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability. This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419 Archer AX53 v1.0 < V1_251215 TL-WR841N v13 < 0.9.1 Build 20231120 Rel.62366

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00429 37th percentileScored 2026-11-07

Fix Fixed Archer C20 v6.0, Archer AX53 v1.0 (TP-Link Systems Inc.): V6_251031, V1_251215Archer C20 V5 (TP-Link Systems Inc.): US_V5_260419, EU_V5_260317+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TP-Link	Archer C20 v6.0, Archer AX53 v1.0	before V6_251031; before V1_251215	V6_251031, V1_251215	Patch available	CNA
TP-Link	Archer C20 V5	before US_V5_260419; before EU_V5_260317	US_V5_260419, EU_V5_260317	Patch available	CNA
TP-Link	TL-WR841N v13	before 0.9.1 Build 20231120 Rel.62366	0.9.1 Build 20231120 Rel.62366	Patch available	CNA

Archer C20 v6.0, Archer AX53 v1.0 VendorTP-Link Affected before V6_251031; before V1_251215 Fixed in V6_251031, V1_251215 Patch available CNA
Archer C20 V5 VendorTP-Link Affected before US_V5_260419; before EU_V5_260317 Fixed in US_V5_260419, EU_V5_260317 Patch available CNA
TL-WR841N v13 VendorTP-Link Affected before 0.9.1 Build 20231120 Rel.62366 Fixed in 0.9.1 Build 20231120 Rel.62366 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:::::::*	1.0	Vulnerable	TP-Link
cpe:2.3:h:tp-link:archer_ax53:-:::::::*	not specified by NVD	Running on	TP-Link
cpe:2.3:o:tp-link:archer_c20_firmware:6.0:::::::*	6.0	Vulnerable	TP-Link
cpe:2.3:h:tp-link:archer_c20:-:::::::*	not specified by NVD	Running on	TP-Link

cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:archer_ax53:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
cpe:2.3:o:tp-link:archer_c20_firmware:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:archer_c20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link

Remediation

Fix · CNA Archer C20 v6.0, Archer AX53 v1.0 (TP-Link Systems Inc.) Fixed in V6_251031, V1_251215
Fix · CNA Archer C20 V5 (TP-Link Systems Inc.) Fixed in US_V5_260419, EU_V5_260317
Fix · CNA TL-WR841N v13 (TP Link Systems Inc.) Fixed in 0.9.1 Build 20231120 Rel.62366

Timeline

2026-10-02 Threatist record created from CVE-2026-0834
2026-10-03 Alias added: GHSA-cpr3-8r3m-jjf4

References

Patch 5

Advisory 1

https://www.tp-link.com/us/support/faq/4905/

Other 1

https://mattg.systems/posts/cve-2026-0834/

TI-2026-23644 OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53 CVSS 4.0HIGH 8.5
TI-2026-23647 OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53 CVSS 4.0HIGH 8.5
TI-2025-38874 Heap-based Buffer Overflow Vulnerability in Archer AX53 and AX12 CVSS 4.0HIGH 8.6
TI-2025-14235 Authenticated Command Injection in mcsd Service of TP-Link Archer AX53 CVSS 4.0HIGH 7.3
TI-2025-14236 Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55 CVSS 4.0HIGH 7.7
TI-2025-38672 Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53 CVSS 4.0HIGH 7.3

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences