CVE-2026-109506Improper Authentication in Multiple TP-Link WiFi Repeaters
Updated under an hour ago ()
Does this affect you?
It affects TP-Link Systems Inc. RE190 v5 and 15 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device’s web-management interface with administrator privileges. Exploitation requires the management login to use HTTP and the attacker to observe the session key, dictionary, and login value associated with a legitimate administrator login. Successful exploitation may allow an unauthenticated adjacent attacker to gain administrator access to the affected device and modify exposed configuration settings.
- CVSS
- 5.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-287
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- TPLink
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 14, 2026
Affected products
TP-Link Systems Inc. RE190 v5 tp_link_systems:re190_v5 (from the name) | before V5_260904 | CNA record |
TP-Link Systems Inc. RE200 v5 tp_link_systems:re200_v5 (from the name) | before V5_260904 | CNA record |
TP-Link Systems Inc. RE205 v4 tp_link_systems:re205_v4 (from the name) | before V4_260904 | CNA record |
TP-Link Systems Inc. RE215 v1 tp_link_systems:re215_v1 (from the name) | before V1_260904 | CNA record |
TP-Link Systems Inc. RE220 v3 tp_link_systems:re220_v3 (from the name) | before V3_260904 | CNA record |
TP-Link Systems Inc. RE230 v2 tp_link_systems:re230_v2 (from the name) | before V2_260904 | CNA record |
TP-Link Systems Inc. RE300 v2 tp_link_systems:re300_v2 (from the name) | before V2_260904 | CNA record |
TP-Link Systems Inc. RE305 v4 tp_link_systems:re305_v4 (from the name) | before V4_260904 | CNA record |
TP-Link Systems Inc. RE330 v1 tp_link_systems:re330_v1 (from the name) | before V1_260904 | CNA record |
TP-Link Systems Inc. RE335 v1 tp_link_systems:re335_v1 (from the name) | before V1_260904 | CNA record |
TP-Link Systems Inc. RE365 v2 tp_link_systems:re365_v2 (from the name) | before V2_260904 | CNA record |
TP-Link Systems Inc. RE365 v3 tp_link_systems:re365_v3 (from the name) | before V3_260904 | CNA record |
TP-Link Systems Inc. RE750C v4 tp_link_systems:re750c_v4 (from the name) | before V4_260904 | CNA record |
TP-Link Systems Inc. RE450 v4.8 tp_link_systems:re450_v4.8 (from the name) | before V4_260915 | CNA record |
TP-Link Systems Inc. RE550 v1 tp_link_systems:re550_v1 (from the name) | before V1_260915 | CNA record |
TP-Link Systems Inc. RE315 v1 tp_link_systems:re315_v1 (from the name) | before V1_260904 rel3959 | CNA record |
References
- https://www.tp-link.com/us/support/download/patch
- https://www.tp-link.com/en/support/download/patch
- https://www.tp-link.com/us/support/faq/5344/vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.