Skip to content
Fencer Vulns
high 8.8

CVE-2026-0834 json

Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13

published 2026-01-21 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-3601

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.

This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_260317 or < US_V5_260419

Archer AX53 v1.0 <

V1_251215

TL-WR841N v13 < 0.9.1 Build 20231120 Rel.62366

Patch / fix

  • TP-Link Systems Inc. Archer C20 v6.0, Archer AX53 v1.0 V1_251215, V6_251031
  • TP-Link Systems Inc. Archer C20 V5 EU_V5_260317, US_V5_260419
  • TP Link Systems Inc. TL-WR841N v13 0.9.1 Build 20231120 Rel.62366

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa vex VA-26-119-02 updated cvss 8.3

TP-Link WR841N Router multiple vulnerabilities

  • TP-Link Systems Inc. Archer AX53 v1.0 <V1_251215 TP-Link Systems Inc. Archer C20 V5 <US_V5_260419, <EU_V5_260317 TP-Link Systems Inc. Archer C20 v6.0 <V6_251031 TP-Link Systems Inc. TL-WR841N v13 <0.9.1 Build 20231120 Rel.62366
    affected: vendor fix tp-link.com
  • TP-Link Systems Inc. Archer AX53 v1.0 V1_251215 TP-Link Systems Inc. Archer C20 V5 US_V5_260419, EU_V5_260317 TP-Link Systems Inc. Archer C20 v6.0 V6_251031 TP-Link Systems Inc. TL-WR841N v13 0.9.1 Build 20231120 Rel.62366
    fixed: vendor fix tp-link.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
9 mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 7.2 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 7.2 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • TP-Link Systems Inc. Archer C20 v6.0, Archer AX53 v1.0
  • TP-Link Systems Inc. Archer C20 V5
  • TP Link Systems Inc. TL-WR841N v13

Classification

Weakness
  • CWE-290 Authentication Bypass by Spoofing

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.