An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation.
Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability.
Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Archer RE650 v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | Archer RE305 v1 | unaffected |
|
||||||
| TP Link Systems Inc. | Archer RE360 v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | TL-WA860RE v4 | unaffected |
|
||||||
| TP-Link Systems Inc. | RE580D v1 | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 22 May 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability. | |
| Title | Authentication Logic Vulnerability on Multiple TP-Link Range Extenders | |
| Weaknesses | CWE-20 | |
| References |
|
|
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: TPLink
Published:
Updated: 2026-05-22T20:48:36.242Z
Reserved: 2026-02-26T19:00:32.766Z
Link: CVE-2026-3294
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses