Authentication Flaw in TP-Link RE305 V3 Allows Unauthorized Password Reset

CVE-2026-102813

What is CVE-2026-102813?

An authentication flaw is detected in the password recovery feature of the TP-Link RE305 V3 router. This vulnerability allows unauthenticated attackers operating on the same local network to exploit the verification code interface. Attackers can trigger the generation of a password-reset verification code without proper authentication due to the absence of an effective attempt counter or lockout mechanism. Additionally, the predictable nature of the verification code generation process exposes it to brute-force attacks. Successful exploitation provides an attacker with the capability to reset the administrator password, thereby gaining unauthorized access to crucial device-management functionalities.

References