Deviceways

Travel router

TP-LINK TL-WR902AC

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
v1 · Qualcomm Atheros QCA9531 / Qualcomm Atheros QCA9887 Wi-Fi
Processor / Wi-Fi: Qualcomm Atheros QCA9531 · Wi-Fi chip: Qualcomm Atheros QCA9887Get OpenWrt firmware Release listed · 25.12.6
v3 · MediaTek MT7610EN / MediaTek MT7628AN Wi-Fi
Processor / Wi-Fi: MediaTek MT7628AN · Wi-Fi chip: MediaTek MT7610ENGet OpenWrt firmware Release listed · 25.12.6
v4 · MediaTek MT7613BE / MediaTek MT7628AN Wi-Fi
Processor / Wi-Fi: MediaTek MT7628AN · Wi-Fi chip: MediaTek MT7613BEGet OpenWrt firmware Release listed · 25.12.6
v1 · Qualcomm Atheros QCA9531
Open hardware record
v3 · MediaTek MT7628AN
Open hardware record Release listed · 25.12.5
Original project github.com

v1 · Qualcomm Atheros QCA9531 / Qualcomm Atheros QCA9887 Wi-Fi

First installation
GUI OEM

v3 · MediaTek MT7610EN / MediaTek MT7628AN Wi-Fi

First installation
U-Boot TFTP recovery

v4 · MediaTek MT7613BE / MediaTek MT7628AN Wi-Fi

Limitations
DFS
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

tp-link tl-wr902ac v1 — device documentation (github.com)

Hardware revision
v1

Device details

tp-link tl-wr902ac v3 — device documentation (github.com)

Hardware revision
v3

Device details

TP-LINK TL-WR902AC v1.x — WikiDevi (github.com)

Hardware revision
v1.x

Device details

TP-LINK TL-WR902AC v3.x — WikiDevi (github.com)

Hardware revision
v3.x

Device details

Device details — v1 — Source documentation (openwrt.org)

Hardware revision
v1

OpenWrt · v1 · Qualcomm Atheros QCA9531 / Qualcomm Atheros QCA9887 Wi-Fi

OpenWrt · v1 · Qualcomm Atheros QCA9531 / Qualcomm Atheros QCA9887 Wi-Fi — v1 — Source documentation (openwrt.org)

Installation routes recorded
GUI OEM
Recovery routes recorded
U-Boot TFTP recovery
Availability recorded by source
Discontinued 2017

Device details

Device details — v3 — Source documentation (openwrt.org)

Hardware revision
v3

OpenWrt · v3 · MediaTek MT7610EN / MediaTek MT7628AN Wi-Fi

OpenWrt · v3 · MediaTek MT7610EN / MediaTek MT7628AN Wi-Fi — v3 — Source documentation (openwrt.org)

Installation routes recorded
U-Boot TFTP recovery
Recovery routes recorded
U-Boot TFTP recovery
Availability recorded by source
Available 2019

Device details

Device details — v4 — Source documentation (openwrt.org)

Hardware revision
v4

OpenWrt · v4 · MediaTek MT7613BE / MediaTek MT7628AN Wi-Fi

OpenWrt · v4 · MediaTek MT7613BE / MediaTek MT7628AN Wi-Fi — v4 — Source documentation (openwrt.org)

Availability recorded by source
Available 2024

Hardware differences

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 8.8 (v3.1)

TP-LINK TL-WR902AC

TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a crafted firmware update…

CVE-2022-48194

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a crafted firmware update because the signature check is inadequate.

CVE published

CVSS 6.8 (v3.0)

TL-WR902AC

TP-Link TL-WR902AC dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-50225

Affected firmware
0.9.1 0.3 v008a.0 Build 211025 Rel.76009n(5553)
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
Public disclosure CVE updated

TP-Link TL-WR902AC dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR902AC routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the libcmm.so module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-21819.

ZDI-23-1809 — TL-WR902AC (zerodayinitiative.com) ↗vendor-provided URL — TL-WR902AC (tp-link.com) ↗
CVE published

CVSS 6.5 (v3.0)

TL-WR902AC

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability

CVE-2023-44447

Affected firmware
TL-WR902AC(EU)_V1_170628
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
Public disclosure CVE updated

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-21529.

ZDI-23-1623 — TL-WR902AC (zerodayinitiative.com) ↗
CVE published

CVSS 5.2 (v4.0)

TL-WR902AC v4

Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

CVE-2026-12001

Affected firmware
Before US_V4_0.9.1 Build 260810 Before EU_V4_0.9.3 Build 260728
Fix
Fix details in the linked record
Read TPLink CVE record
Details and sources
CVE updated

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis.

Successful exploitation could result in unauthorized access to privileged functions on affected devices.

CVE published

TL-WR902AC

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands

CVE-2023-36489

Affected firmware
firmware versions prior to 'TL-WR902AC(JP)_V3_230506'
Fix
Fix details in the linked record
Read jpcert CVE record
Details and sources
CVE updated

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: TL-WR802N firmware versions prior to 'TL-WR802N(JP)_V4_221008', TL-WR841N firmware versions prior to 'TL-WR841N(JP)_V14_230506', and TL-WR902AC firmware versions prior to 'TL-WR902AC(JP)_V3_230506'.

Check more security advisories for this device · CVE.org