Read the docs
TI-2026-02845 Aliases CVE-2026-3294GHSA-x4px-5wq7-9jm8

Authentication Logic Vulnerability on Multiple TP-Link Range Extenders

Priority MEDIUM 40CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Fix Fixed Archer RE650 v1 (TP-Link Systems Inc.): V1_20260429Archer RE305 v1 (TP-Link Systems Inc.): V1_20260515+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkArcher RE650 v1before V1_20260429V1_20260429Patch availableCNA
TP-LinkArcher RE305 v1before V1_20260515V1_20260515Patch availableCNA
TP-LinkArcher RE360 v1before V1_20260515V1_20260515Patch availableCNA
TP-LinkTL-WA860RE v4before V4_20260515V4_20260515Patch availableCNA
TP-LinkRE580D v1before V1_20260515V1_20260515Patch availableCNA
  • Archer RE650 v1 VendorTP-Link Affected before V1_20260429 Fixed in V1_20260429 Patch available CNA
  • Archer RE305 v1 VendorTP-Link Affected before V1_20260515 Fixed in V1_20260515 Patch available CNA
  • Archer RE360 v1 VendorTP-Link Affected before V1_20260515 Fixed in V1_20260515 Patch available CNA
  • TL-WA860RE v4 VendorTP-Link Affected before V4_20260515 Fixed in V4_20260515 Patch available CNA
  • RE580D v1 VendorTP-Link Affected before V1_20260515 Fixed in V1_20260515 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:re305_firmware:*:*:*:*:*:*:*:*before 20260515VulnerableTP-Link
cpe:2.3:h:tp-link:re305:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
cpe:2.3:o:tp-link:re360_firmware:*:*:*:*:*:*:*:*before 20260515VulnerableTP-Link
cpe:2.3:h:tp-link:re360:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
cpe:2.3:o:tp-link:re580d_firmware:*:*:*:*:*:*:*:*before 20260515VulnerableTP-Link
cpe:2.3:h:tp-link:re580d:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
cpe:2.3:o:tp-link:re650_firmware:*:*:*:*:*:*:*:*before 20260429VulnerableTP-Link
cpe:2.3:h:tp-link:re650:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
cpe:2.3:o:tp-link:tl-wa860re_firmware:*:*:*:*:*:*:*:*before 20260515VulnerableTP-Link
cpe:2.3:h:tp-link:tl-wa860re:4.0:*:*:*:*:*:*:*4.0Running onTP-Link
  • cpe:2.3:o:tp-link:re305_firmware:*:*:*:*:*:*:*:* Versions before 20260515 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:re305:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:re360_firmware:*:*:*:*:*:*:*:* Versions before 20260515 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:re360:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:re580d_firmware:*:*:*:*:*:*:*:* Versions before 20260515 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:re580d:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:re650_firmware:*:*:*:*:*:*:*:* Versions before 20260429 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:re650:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:tl-wa860re_firmware:*:*:*:*:*:*:*:* Versions before 20260515 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tl-wa860re:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·TP-Link

Remediation

  • Fix · CNA Archer RE650 v1 (TP-Link Systems Inc.) Fixed in V1_20260429
  • Fix · CNA Archer RE305 v1 (TP-Link Systems Inc.) Fixed in V1_20260515
  • Fix · CNA Archer RE360 v1 (TP Link Systems Inc.) Fixed in V1_20260515
  • Fix · CNA TL-WA860RE v4 (TP-Link Systems Inc.) Fixed in V4_20260515
  • Fix · CNA RE580D v1 (TP-Link Systems Inc.) Fixed in V1_20260515

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3294
  2. 2026-10-03 Alias added: GHSA-x4px-5wq7-9jm8

References

Patch 10

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences