Authentication Logic Vulnerability in TP-Link Range Extenders
CVE-2026-3294

8.7HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Archer Re650 V1
Archer Re305 V1
Archer Re360 V1
Tl-wa860re V4
Vendor
CVE Published:
22 May 2026

What is CVE-2026-3294?

An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to exploit a weakness in the login mechanism. By manipulating specific parameters, attackers can reset the administrator password due to inadequate input validation. This exploitation grants full administrative control over the device, posing significant risks to its confidentiality, integrity, and availability.

Affected Version(s)

Archer RE305 v1 0

Archer RE360 v1 0

Archer RE650 v1 0

References

https://www.tp-link.com/en/support/download/re650/v1/#Fir...
patch
https://www.tp-link.com/us/support/download/re650/v1/#Fir...
patch
https://www.tp-link.com/us/support/download/re305/v1/#Fir...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Job Jobse
.