Critical Severity
Published: Oct 30, 2026
Root RCE via authenticated OS command injection in the TP-Link Archer AXE300 ISP Speed Test (spdt_server -> sys.fork_call). Firmware 1.0.11. CWE-78, CVSS 8.5.
# TP-Link Archer AXE300 — authenticated command injection (root RCE) in the ISP Speed Test
[](#scoring)
[](https://cwe.mitre.org/data/definitions/78.html)
[](#am-i-affected)
[](#platform-notes)
[](https://www.tp-link.com/us/support/faq/4935/)
[](#summary)
[](LICENSE)
**`spdt_server` is concatenated into a shell command string and executed as `root` on the router.**
A remote attacker holding the Archer AXE300's admin web UI credential can send a single HTTP
request to the router's own JSON API and run arbitrary shell commands as root — full compromise
of the device and, because the router is the network gateway, of everything behind it. The
flaw is CWE-78 (OS command injection) in the vendor's LuCI model layer, present in the
**latest shipping firmware, 1.0.11 Build 20241115**, on a model that is **not** covered by
TP-Link's own command-injection advisory.
> **Disclosure status.**
> Published publicly in this repository on **2026-10-24**, before the vendor was notified. The finding was then reported to TP-Link's Product Security Team at [email protected] on **2026-10-26**. As of this update, TP-Link has published no fix, advisory, or CVE for this model or code path. The advisory summary is also filed as a pinned issue:
> [#1 — Au