Unauthorized Access Risk in TP-Link Wi-Fi Range Extenders

CVE-2026-109506

What is CVE-2026-109506?

Multiple TP-Link Wi-Fi range extenders exhibit a vulnerability in their web-management login flow, utilizing a custom XOR-and-dictionary transformation. An attacker on the same local network can capture traffic during legitimate administrator login attempts. By observing the session key, dictionary, and login values, the attacker may derive an alternative credential that successfully authenticates to the device’s web-management interface as an administrator, enabling the modification of sensitive configuration settings.

References