CVE-2020-10882

The record

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. When parsing the slave_mac parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9650.

Affected packages

Related vulnerabilities

• CVE-2026-62853 ThingLinks is an enterprise IoT platform. CWE-78
• CVE-2026-119335 Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing… CWE-78
• CVE-2026-116241 pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO… CWE-78
• CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability… CWE-78
• CVE-2026-119288 Zuke is a code-first, strongly typed build automation system for Deno. CWE-78
• CVE-2026-118238 The Tenda W18E web management server is vulnerable to OS command injection via the… CWE-78
• CVE-2026-91913 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization… CWE-78
• CVE-2026-118992 CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell… CWE-78