Loading story…
STAR Labs detailed exploitation of CVE-2020-10882, an unauthenticated remote code execution flaw in TP-Link Archer A7 AC1750 routers and related Archer C7 firmware. The bug affects the tdpServer service listening on UDP port 20002, where the slave_mac value from an encrypted JSON message is insufficiently validated before being passed to system(), allowing a network-adjacent attacker to execute commands as root. The researchers said the issue was also used at Pwn2Own 2019.
The writeup shows how reverse engineering and bindiffing of vulnerable and patched firmware exposed the vulnerable code path and reconstructed TP-Link's proprietary TDP protocol, including its 16-byte header, checksum validation, and AES-CBC payload encryption using hardcoded key and IV material. By crafting a slave_key_offer message with specific header values and a malicious slave_mac, an attacker can bypass authentication and trigger command injection; despite a short input-length limit, the exploit can assemble commands across multiple packets, execute a script, and obtain a shell, including altering web content hosted on the router.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
STAR Labs published a detailed write-up analyzing CVE-2020-10882, including reverse engineering of the TDP protocol, identification of the vulnerable tdpServer code path, and reconstruction of packet encryption and checksum handling. The post also released proof-of-concept exploitation details showing remote shell access and arbitrary modification of router web content.
CVE-2020-10882, an unauthenticated remote code execution flaw in the TP-Link Archer A7/related Archer C7 firmware, was used during Pwn2Own 2019. The bug was in the tdpServer service on UDP port 20002, where the slave_mac field could be abused for command injection leading to root-level code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TP-Link Archer AX53 v1.0 routers were found to contain two high-severity OS command injection vulnerabilities, tracked as **`CVE-2026-30815`** and **`CVE-2026-30818`**, affecting the device's OpenVPN and dnsmasq modules. In both cases, an authenticated attacker on an adjacent network can supply a specially crafted configuration file to trigger arbitrary command execution because of insufficient input validation, a weakness classified as **`CWE-78`**. Successful exploitation could let an attacker alter router configuration, access sensitive information, and undermine overall device integrity and availability. The flaws affect Archer AX53 v1.0 firmware releases prior to **`1.7.1 Build 20260213`**, and the CVSS v4.0 assessments indicate low attack complexity under adjacent-network conditions with high impact across confidentiality, integrity, and availability.
Jun 29, 2026
TP-Link issued a security advisory for an **authenticated command injection** vulnerability in the *Archer MR600 v5* router’s web-based admin interface, tracked as **CVE-2025-14756** with a **CVSS 8.5** rating. The flaw stems from insufficient input sanitization in the admin interface component, enabling a logged-in attacker to execute arbitrary system commands by submitting crafted input via the browser’s developer console; while the injected command length is limited, successful exploitation can still result in service disruption or full device compromise. Affected devices are **Archer MR600 v5** units running firmware versions prior to the fixed release (reported as versions below `v0001.0 Build 250930 Rel.63611n` / older than `1.1.0` and including `0.9.1` and below, depending on versioning notation in the advisory). The reported attack conditions include requiring valid admin credentials and adjacent network access, but the impact is high due to potential complete router takeover; TP-Link’s recommended mitigation is to **apply the latest firmware update immediately**, and one report notes the model is not sold in the United States, potentially limiting exposure there.
Jun 29, 2026
TP-Link has disclosed and patched a high-severity authenticated command injection flaw, **CVE-2026-5509**, affecting **Archer BE450 v1** and **BE7200 v1** routers. The vulnerability in the web management interface carries a **CVSS 8.5** score and can let an attacker who has already gained administrative access execute arbitrary system commands, potentially leading to elevated privileges, configuration tampering, unauthorized service execution, and interception of sensitive network traffic. TP-Link said devices running firmware earlier than **`1.3.0 Build 20260416`** are vulnerable and urged customers to install the latest firmware from its regional support portals. The disclosure follows broader reporting on security weaknesses affecting **TP-Link Archer NX** routers, adding to concerns over exploitable flaws in the vendor’s consumer networking lineup. Together, the reports highlight continued risk in internet-facing router management functions, where compromised credentials or prior access can turn web interface bugs into full device compromise. Organizations and home users using affected Archer models should verify firmware versions, restrict administrative access, and apply vendor updates immediately.
Jun 29, 2026