Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

TP-Link Wi‑Fi repeaters allow admin login from nearby attacker

CVE-2026-109506 · published 21 days ago
Summary

Several TP-Link Wi‑Fi range extenders can be tricked into accepting a forged login when an attacker on the same local network watches the unencrypted login traffic. By reproducing the simple transformation used, the attacker can gain full administrator access to the device's web‑management interface and change its settings. Use HTTPS for the management interface or apply the vendor's security update to protect against this risk.

What to do
  • Update tp-link systems inc. re190 v5 to version V5_260904 or later.
  • Update tp-link systems inc. re200 v5 to version V5_260904 or later.
  • Update tp-link systems inc. re205 v4 to version V4_260904 or later.
  • Update tp-link systems inc. re215 v1 to version V1_260904 or later.
  • Update tp-link systems inc. re220 v3 to version V3_260904 or later.
  • Update tp-link systems inc. re230 v2 to version V2_260904 or later.
  • Update tp-link systems inc. re300 v2 to version V2_260904 or later.
  • Update tp-link systems inc. re305 v4 to version V4_260904 or later.
  • Update tp-link systems inc. re330 v1 to version V1_260904 or later.
  • Update tp-link systems inc. re335 v1 to version V1_260904 or later.
  • Update tp-link systems inc. re365 v2 to version V2_260904 or later.
  • Update tp-link systems inc. re365 v3 to version V3_260904 or later.
  • Update tp-link systems inc. re750c v4 to version V4_260904 or later.
  • Update tp-link systems inc. re450 v4.8 to version V4_260915 or later.
  • Update tp-link systems inc. re550 v1 to version V1_260915 or later.
  • Update tp-link systems inc. re315 v1 to version V1_260904 rel3959 or later.
Affected software
VendorProductAffected versions
tp-link systems inc. re190 v5 < V5_260904
tp-link systems inc. re200 v5 < V5_260904
tp-link systems inc. re205 v4 < V4_260904
tp-link systems inc. re215 v1 < V1_260904
tp-link systems inc. re220 v3 < V3_260904
tp-link systems inc. re230 v2 < V2_260904
tp-link systems inc. re300 v2 < V2_260904
tp-link systems inc. re305 v4 < V4_260904
tp-link systems inc. re330 v1 < V1_260904
tp-link systems inc. re335 v1 < V1_260904
tp-link systems inc. re365 v2 < V2_260904
tp-link systems inc. re365 v3 < V3_260904
tp-link systems inc. re750c v4 < V4_260904
tp-link systems inc. re450 v4.8 < V4_260915
tp-link systems inc. re550 v1 < V1_260915
tp-link systems inc. re315 v1 < V1_260904 rel3959
Original advisory text
Improper Authentication in Multiple TP-Link WiFi Repeaters
Multiple
TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary
transformation in the HTTP web-management login flow. An unauthenticated attacker
on the same local network who can capture the network traffic associated with
legitimate administrator login may be able to derive an alternative credential
value that produces the same accepted authentication result and use it to
authenticate to the device’s web-management interface with administrator
privileges. Exploitation requires the management login to use HTTP and the
attacker to observe the session key, dictionary, and login value associated
with a legitimate administrator login.





Successful
exploitation may allow an unauthenticated adjacent attacker to gain
administrator access to the affected device and modify exposed configuration
settings.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published14 Oct 2026
Updated4 Nov 2026
First seen14 Oct 2026
Sources
CVE-2026-109506 · NVD
CVE-2026-109506 · MITRE
Track software like this
Free during beta