TP-Link RE305: Authentication weakness in TDDP v2 allows root command execution
Summary
The TP-Link RE305 V3 range extender has an authentication weakness in its TDDP v2 service. The service uses a fixed, derivable cryptographic key, so an unauthenticated attacker on the same local network can forge protocol packets and reach privileged TDDP functions. Successful exploitation can lead to arbitrary system commands with root privileges, provided the TDDP service is running and reachable.
Affected
- TP-Link RE305 V3, versions 0 to before 1.1.8 Build 20260921 Rel. 42853
- Other hardware versions: not listed for this CVE
- Default configuration: unaffected according to the CVE record
Fixed in
- Firmware 1.1.8 Build 20260921 Rel. 42853 or later (per vendor FAQ and CVE record). Confirm the download is available on the vendor page before rollout.
Workaround
Unknown. The vendor has not published a workaround. Interim measures: do not operate the extender in guest or untrusted network segments, and restrict LAN access to it to authorized hosts.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- OffSeq: not known to be exploited.
- No public proof of concept found.
Our recommendation
- Inventory all RE305 V3 devices in the business network.
- Update to 1.1.8 Build 20260921 Rel. 42853 or later once the build is verified.
- Until patched, separate the extender from guest and untrusted networks and limit LAN access to it.
- Monitor NVD and CISA KEV for updates.
- Ask TP-Link to confirm the score and description, which differ between sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TP-Link FAQ 5362 (vendor advisory) www.tp-link.com
- TP-Link Download Center RE305 V3 (US) www.tp-link.com
- CVE-2026-102814 record (threatint) cve.threatint.com
- CVE-2026-102814 (Strix) www.strix.ai
- CVE-2026-102814 (OffSeq Radar) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:53.
Original description (NVD)
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionality that can lead to operating-system command execution when the TDDP service is running and accessible. Successful exploitation may allow an unauthenticated attacker on the same local area network to execute arbitrary system commands with root privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.