CVE-2026-84682
Description
A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.
Is your site exposed to CVE-2026-84682?
Run a free security scan — no signup, results in seconds.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-84682? +
How do I check if I'm vulnerable to CVE-2026-84682? +
Related Vulnerabilities
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From …
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named …
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) …
Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted …
An OS Command Injection vulnerability exists in Aterm. If a malicious third person gains administrator access to the product’s web …
3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) allows authenticated users to execute arbitrary shell commands in the context …