Read the docs
TI-2026-74415 Aliases CVE-2026-109506

Improper authentication in multiple TP-Link Wi-Fi range extenders

Priority LOW 26CWE-287Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

TP-Link Wi-Fi range extenders, including the RE190 v5, RE200 v5, RE205 v4, RE215 v1, RE220 v3 and other models, are affected before their fixed firmware versions. The web-management login uses a custom, reversible XOR-and-dictionary transformation, which is improper authentication (CWE-287). An unauthenticated attacker on the same local network who captures traffic from a legitimate administrator login over HTTP may derive an alternative credential value and gain administrator access to the device.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device’s web-management interface with administrator privileges. Exploitation requires the management login to use HTTP and the attacker to observe the session key, dictionary, and login value associated with a legitimate administrator login. Successful exploitation may allow an unauthenticated adjacent attacker to gain administrator access to the affected device and modify exposed configuration settings.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed RE190 v5 (TP-Link Systems Inc.): V5_260904RE200 v5 (TP-Link Systems Inc.): V5_260904+14 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkRE190 v5before V5_260904V5_260904Patch availableCNA
TP-LinkRE200 v5before V5_260904V5_260904Patch availableCNA
TP-LinkRE205 v4before V4_260904V4_260904Patch availableCNA
TP-LinkRE215 v1before V1_260904V1_260904Patch availableCNA
TP-LinkRE220 v3before V3_260904V3_260904Patch availableCNA
TP-LinkRE230 v2before V2_260904V2_260904Patch availableCNA
TP-LinkRE300 v2before V2_260904V2_260904Patch availableCNA
TP-LinkRE305 v4before V4_260904V4_260904Patch availableCNA
TP-LinkRE330 v1before V1_260904V1_260904Patch availableCNA
TP-LinkRE335 v1before V1_260904V1_260904Patch availableCNA
TP-LinkRE365 v2before V2_260904V2_260904Patch availableCNA
TP-LinkRE365 v3before V3_260904V3_260904Patch availableCNA
TP-LinkRE750C v4before V4_260904V4_260904Patch availableCNA
TP-LinkRE450 v4.8before V4_260915V4_260915Patch availableCNA
TP-LinkRE550 v1before V1_260915V1_260915Patch availableCNA
TP-LinkRE315 v1before V1_260904 rel3959V1_260904 rel3959Patch availableCNA
  • RE190 v5 VendorTP-Link Affected before V5_260904 Fixed in V5_260904 Patch available CNA
  • RE200 v5 VendorTP-Link Affected before V5_260904 Fixed in V5_260904 Patch available CNA
  • RE205 v4 VendorTP-Link Affected before V4_260904 Fixed in V4_260904 Patch available CNA
  • RE215 v1 VendorTP-Link Affected before V1_260904 Fixed in V1_260904 Patch available CNA
  • RE220 v3 VendorTP-Link Affected before V3_260904 Fixed in V3_260904 Patch available CNA
  • RE230 v2 VendorTP-Link Affected before V2_260904 Fixed in V2_260904 Patch available CNA
  • RE300 v2 VendorTP-Link Affected before V2_260904 Fixed in V2_260904 Patch available CNA
  • RE305 v4 VendorTP-Link Affected before V4_260904 Fixed in V4_260904 Patch available CNA
  • RE330 v1 VendorTP-Link Affected before V1_260904 Fixed in V1_260904 Patch available CNA
  • RE335 v1 VendorTP-Link Affected before V1_260904 Fixed in V1_260904 Patch available CNA
  • RE365 v2 VendorTP-Link Affected before V2_260904 Fixed in V2_260904 Patch available CNA
  • RE365 v3 VendorTP-Link Affected before V3_260904 Fixed in V3_260904 Patch available CNA
  • RE750C v4 VendorTP-Link Affected before V4_260904 Fixed in V4_260904 Patch available CNA
  • RE450 v4.8 VendorTP-Link Affected before V4_260915 Fixed in V4_260915 Patch available CNA
  • RE550 v1 VendorTP-Link Affected before V1_260915 Fixed in V1_260915 Patch available CNA
  • RE315 v1 VendorTP-Link Affected before V1_260904 rel3959 Fixed in V1_260904 rel3959 Patch available CNA

Remediation

Upgrade RE190 v5 and RE200 v5 to V5_260904, RE205 v4, RE305 v4 and RE750C v4 to V4_260904, RE220 v3 and RE365 v3 to V3_260904, RE230 v2, RE300 v2 and RE365 v2 to V2_260904, RE215 v1, RE330 v1 and RE335 v1 to V1_260904, RE550 v1 to V1_260915, and RE450 v4.8 to V4_260915.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA RE190 v5 (TP-Link Systems Inc.) Fixed in V5_260904
  • Fix · CNA RE200 v5 (TP-Link Systems Inc.) Fixed in V5_260904
  • Fix · CNA RE205 v4 (TP-Link Systems Inc.) Fixed in V4_260904
  • Fix · CNA RE215 v1 (TP-Link Systems Inc.) Fixed in V1_260904
  • Fix · CNA RE220 v3 (TP-Link Systems Inc.) Fixed in V3_260904
  • Fix · CNA RE230 v2 (TP-Link Systems Inc.) Fixed in V2_260904
  • Fix · CNA RE300 v2 (TP-Link Systems Inc.) Fixed in V2_260904
  • Fix · CNA RE305 v4 (TP-Link Systems Inc.) Fixed in V4_260904
  • Fix · CNA RE330 v1 (TP-Link Systems Inc.) Fixed in V1_260904
  • Fix · CNA RE335 v1 (TP-Link Systems Inc.) Fixed in V1_260904
  • Fix · CNA RE365 v2 (TP-Link Systems Inc.) Fixed in V2_260904
  • Fix · CNA RE365 v3 (TP-Link Systems Inc.) Fixed in V3_260904
  • Fix · CNA RE750C v4 (TP-Link Systems Inc.) Fixed in V4_260904
  • Fix · CNA RE450 v4.8 (TP-Link Systems Inc.) Fixed in V4_260915
  • Fix · CNA RE550 v1 (TP-Link Systems Inc.) Fixed in V1_260915
  • Fix · CNA RE315 v1 (TP-Link Systems Inc.) Fixed in V1_260904 rel3959

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-109506
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Priority changed: MEDIUM → LOW

References

Patch 2

Advisory 1

  • TI-2023-16571 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain… KEVCVSS 3.1HIGH 8.8
  • TI-2023-01313 Command injection in TP-Link Archer AX21 KEVCVSS 3.1HIGH 8.8
  • TI-2020-14907 TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the… KEVCVSS 3.1HIGH 8.8
  • TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
  • TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
  • TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
See all 636 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences