CVE-2026-109506

Deferred Deferred - Pending Action

Authentication Bypass in TP-Link Wi-Fi Range Extenders

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: TPLink

Description

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device’s web-management interface with administrator privileges. Exploitation requires the management login to use HTTP and the attacker to observe the session key, dictionary, and login value associated with a legitimate administrator login. Successful exploitation may allow an unauthenticated adjacent attacker to gain administrator access to the affected device and modify exposed configuration settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109506

EUVD

EUVD-2026-101602

Affected Vendors & Products

Vendor	Product	Version / Range
TP-Link	Systems	Inc. RE190 v5 0
TP-Link	Systems	Inc. RE200 v5 0
TP-Link	Systems	Inc. RE205 v4 0
TP-Link	Systems	Inc. RE215 v1 0
TP-Link	Systems	Inc. RE220 v3 0
TP-Link	Systems	Inc. RE230 v2 0
TP-Link	Systems	Inc. RE300 v2 0
TP-Link	Systems	Inc. RE305 v4 0
TP-Link	Systems	Inc. RE330 v1 0
TP-Link	Systems	Inc. RE335 v1 0
TP-Link	Systems	Inc. RE365 v2 0
TP-Link	Systems	Inc. RE365 v3 0
TP-Link	Systems	Inc. RE750C v4 0
TP-Link	Systems	Inc. RE450 v4.8 0
TP-Link	Systems	Inc. RE550 v1 0
TP-Link	Systems	Inc. RE315 v1 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

CVE-2026-109506 is an improper authentication vulnerability in multiple TP-Link Wi-Fi range extenders. It involves a custom, reversible XOR-and-dictionary transformation used during HTTP web-management login. An unauthenticated attacker on the same local network can capture legitimate administrator login traffic and derive an alternative credential that grants administrator access to the device's web interface.

Detection Guidance

To detect this vulnerability, monitor network traffic for HTTP-based login attempts to TP-Link range extenders. Capture packets using tools like Wireshark or tcpdump and inspect for the custom XOR-and-dictionary transformation in login flows. Check if the device's web interface uses HTTP instead of HTTPS.

Impact Analysis

An attacker could exploit this to gain administrator access to your TP-Link Wi-Fi extender, allowing them to modify configuration settings. This requires the attacker to be on the same local network and observe a legitimate login session over HTTP.

Compliance Impact

This vulnerability allows unauthorized local network attackers to gain administrator access to TP-Link Wi-Fi range extenders, potentially enabling configuration changes. Such unauthorized access could lead to violations of data protection standards like GDPR or HIPAA by exposing sensitive network traffic or altering security settings.

Mitigation Strategies

Immediately update affected TP-Link range extenders to the latest firmware released in September 2026. Disable HTTP access to the device's web interface and enforce HTTPS. Restrict local network access to the device's management interface if possible.

Hi! I’m here to help you understand CVE-2026-109506. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70