CyberRota Analysis
AI-GeneratedA command injection vulnerability in the TDDPv2 service on Archer AX90 V1 allows unauthenticated adjacent-network attackers to execute arbitrary operating system commands with root privileges during device boot. This could lead to complete device compromise, making it critical for organizations using this device to prioritize remediation. Network administrators and security teams should assess their exposure and apply necessary patches or mitigations promptly.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.