Security Advisory on Logic Vulnerability on Archer C20 and AX53 (CVE-2026-0834)

Vulnerability Description:

Logic vulnerability in TP-Link Archer C20 v6.0 and Archer AX53 v1.0 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials.

Impact:

Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.

CVE-2026-0834:

CVSS v4.0 Score: 5.3 / Medium

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendations:

We strongly recommend that users with affected devices take the following actions:

1. Download and update to the latest firmware version to fix the vulnerabilities.

https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware

https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware

Disclaimer:

If you do not take all recommended actions, this vulnerability will remain. TP-Link cannot bear any responsibility for consequences that could have been avoided by following this advisory.