Authentication Weakness in TP-Link RE305 V3 Wi-Fi Range Extender
CVE-2026-102814

8.7HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Re305 V3
Vendor
CVE Published:
27 October 2026

What is CVE-2026-102814?

An authentication vulnerability exists in the TP-Link RE305 V3 Wi-Fi Range Extender's TDDP v2 service, utilizing a fixed and derivable cryptographic key. This weakness could enable an unauthorized attacker on the same local network to craft and send malicious protocol packets. If successfully exploited, this can lead to unauthorized access to privileged TDDP operations, creating opportunities for executing arbitrary system commands with elevated privileges when the TDDP service is active.

Affected Version(s)

RE305 v3 0 < 1.1.8 Build 20260921 Rel. 42853

References

https://www.tp-link.com/us/support/download/re305/v3/#Fir...
patch
https://www.tp-link.com/en/support/download/re305/v3/#Fir...
patch
https://www.tp-link.com/us/support/faq/5362/
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Victor Mota
.