CVE-2026-109506
Received
Received - Intake
Authentication Bypass in TP-Link Wi-Fi Range Extenders
Vulnerability report for CVE-2026-109506, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: TPLink
Description
Description
Multiple
TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary
transformation in the HTTP web-management login flow. An unauthenticated attacker
on the same local network who can capture the network traffic associated with
legitimate administrator login may be able to derive an alternative credential
value that produces the same accepted authentication result and use it to
authenticate to the device’s web-management interface with administrator
privileges. Exploitation requires the management login to use HTTP and the
attacker to observe the session key, dictionary, and login value associated
with a legitimate administrator login.
Successful
exploitation may allow an unauthenticated adjacent attacker to gain
administrator access to the affected device and modify exposed configuration
settings.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| TP-Link | Systems | Inc. RE190 v5 0 |
| TP-Link | Systems | Inc. RE200 v5 0 |
| TP-Link | Systems | Inc. RE205 v4 0 |
| TP-Link | Systems | Inc. RE215 v1 0 |
| TP-Link | Systems | Inc. RE220 v3 0 |
| TP-Link | Systems | Inc. RE230 v2 0 |
| TP-Link | Systems | Inc. RE300 v2 0 |
| TP-Link | Systems | Inc. RE305 v4 0 |
| TP-Link | Systems | Inc. RE330 v1 0 |
| TP-Link | Systems | Inc. RE335 v1 0 |
| TP-Link | Systems | Inc. RE365 v2 0 |
| TP-Link | Systems | Inc. RE365 v3 0 |
| TP-Link | Systems | Inc. RE750C v4 0 |
| TP-Link | Systems | Inc. RE450 v4.8 0 |
| TP-Link | Systems | Inc. RE550 v1 0 |
| TP-Link | Systems | Inc. RE315 v1 0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
