CVE-2026-109506
MEDIUM 5.9Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device’s web-management interface with administrator privileges. Exploitation requires the management login to use HTTP and the attacker to observe the session key, dictionary, and login value associated with a legitimate administrator login. Successful exploitation may allow an unauthenticated adjacent attacker to gain administrator access to the affected device and modify exposed configuration settings.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 28th percentile
Impact if exploited
5.9CVSS 4.0 · MEDIUM
- ConfidentialityHigh
- IntegrityNone
- AvailabilityNone
What an attacker needs
- ⚠Access: Must sit on the same / adjacent network
- ✓Privileges: No account or privileges required
- ⚠User interaction: Succeeds with passive user activity
- ⚠Complexity: Needs a race window or specific setup
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Vendors Tp Link Systems Inc.
Products Re190 V5 Re200 V5 Re205 V4 Re215 V1 Re220 V3 Re230 V2 Re300 V2 Re305 V4 Re330 V1 Re335 V1 Re365 V2 Re365 V3
Weakness (CWE)
- CWE-287: Improper Authentication
CVSS vector
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
1 candidate
- https://github.com/lukaspalm/CVE-2026-109506
Technical writeup of CVE-2026-109506, a vulnerability I found in multiple TP-Link Wi-Fi Range Extenders
PoC-in-GitHub · CVE-2026-109506
PoC-in-GitHub · CVE-2026-109506 · Updated 2026-10-15T05:37:46Z
All CVSS metrics
- MEDIUM 5.9 v4.0 · CNA Primary
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - MEDIUM 5.9 v4.0 · NVD Secondary
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
Patches & mitigations
- https://www.tp-link.com/us/support/download/ CVE record · TPLink · Updated 2026-10-14T18:31:37.228Z
NVD · CVE-2026-109506 · Updated 2026-10-15T20:17:06.997 - https://www.tp-link.com/en/support/download/ CVE record · TPLink · Updated 2026-10-14T18:31:37.228Z
NVD · CVE-2026-109506 · Updated 2026-10-15T20:17:06.997
Advisories
- https://www.tp-link.com/us/support/faq/5344/ CVE record · TPLink · Updated 2026-10-14T18:31:37.228Z
NVD · CVE-2026-109506 · Updated 2026-10-15T20:17:06.997 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101602 EUVD · EUVD-2026-101602