Vulnerability Description
An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tp-Link | Re305 Firmware | < 20260515 |
| Tp-Link | Re305 | 1.0 |
| Tp-Link | Re360 Firmware | < 20260515 |
| Tp-Link | Re360 | 1.0 |
| Tp-Link | Re580D Firmware | < 20260515 |
| Tp-Link | Re580D | 1.0 |
| Tp-Link | Re650 Firmware | < 20260429 |
| Tp-Link | Re650 | 1.0 |
| Tp-Link | Tl-Wa860Re Firmware | < 20260515 |
| Tp-Link | Tl-Wa860Re | 4.0 |
Related Weaknesses (CWE)
References
- https://www.tp-link.com/en/support/download/re305/v1/#FirmwareProduct
- https://www.tp-link.com/en/support/download/re360/v1/#FirmwareProduct
- https://www.tp-link.com/en/support/download/re580d/#FirmwareProduct
- https://www.tp-link.com/en/support/download/re650/v1/#FirmwareProduct
- https://www.tp-link.com/en/support/download/tl-wa860re/v4/#FirmwareProduct
- https://www.tp-link.com/us/support/download/re305/v1/#FirmwareProduct
- https://www.tp-link.com/us/support/download/re360/v1/#FirmwareProduct
- https://www.tp-link.com/us/support/download/re580d/#FirmwareProduct
- https://www.tp-link.com/us/support/download/re650/v1/#FirmwareProduct
- https://www.tp-link.com/us/support/download/tl-wa860re/v4/#FirmwareProduct
- https://www.tp-link.com/us/support/faq/5101/Vendor Advisory
FAQ
What is CVE-2026-3294?
CVE-2026-3294 is a vulnerability with a CVSS score of 8.8 (HIGH). An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password...
How severe is CVE-2026-3294?
CVE-2026-3294 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-3294?
Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link Re305 Firmware, Tp-Link Re305, Tp-Link Re360 Firmware, Tp-Link Re360, Tp-Link Re580D Firmware.