An operating‑system command injection vulnerability exists in the tmpServer service of TP‑Link RE305 V3. The service runs with root privileges and listens only on the local loopback interface. A local attacker with access to a low‑privileged process can submit a crafted request to the TDDPv1 interface, causing the service to execute arbitrary commands as root. The resulting impact is local privilege escalation to root and the ability to run any operating‑system command on the device.

TP‑Link Systems Inc. products affected are the RE305 routers running firmware version v3.

The vulnerability scores a CVSS of 6.9, indicating moderate severity. EPSS data is not available, so the exploitation likelihood is unknown, but the flaw is only exploitable by attackers who already have local low‑privileged access. The KEV catalog does not list this issue, suggesting it has not been widely exploited yet. Attackers would need an existing foothold on the device, such as from an untrusted web application or a compromised process, to trigger the injection. If they succeed, they can elevate to root and control the router.