PT-2026-3791 · Tp Link · Archer C20+1

Matt Graham · Published 2026-01-21 · Updated 2026-02-02 · CVE-2026-0834

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link Archer C20 versions prior to V6 251031 TP-Link Archer AX53 version prior to V1 251215

Description A logic issue exists in the TDDP module of TP-Link Archer C20 v6.0 and Archer AX53 v1.0. An unauthenticated attacker on an adjacent network can execute administrative commands, including factory reset and device reboot, without credentials. This can lead to configuration loss and interruption of device availability.

Recommendations Update TP-Link Archer C20 to version V6 251031 or later. Update TP-Link Archer AX53 to version V1 251215 or later.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2026-01009

CVE-2026-0834

Affected Products

Archer Ax53

Archer C20

References · 14

• https://tp-link.com/us/support/download/archer-c20/v5/#Firmware · Patch
• https://osv.dev/vulnerability/CVE-2026-0834 · Vendor Advisory
• https://tp-link.com/us/support/faq/4905 · Vendor Advisory
• https://tp-link.com/en/support/download/archer-c20/v5/#Firmware · Patch
• https://tp-link.com/en/support/download/archer-ax53/v1/#Firmware · Patch
• https://tp-link.com/us/support/download/tl-wr841n/v13/#Firmware · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-0834 · Security Note
• https://bdu.fstec.ru/vul/2026-01009 · Security Note
• https://tp-link.com/en/support/download/archer-c20/v6/#Firmware · Patch
• https://t.me/CVEtracker/42682 · Telegram Post
• https://killing.systems/posts/cve-2026-0834 · Note
• https://twitter.com/mattgsys/status/2018404945582538833 · Twitter Post
• https://tp-link.com/uk/support/faq/4905 · Note
• https://mattg.systems/posts/cve-2026-0834 · Note