Skip to content
OpenAdvisories
Medium · 5.9 Public exploit CVE-2026-109506 EUVD-2026-101602GHSA-v8j9-72vh-g46g

Improper Authentication in Multiple TP-Link WiFi Repeaters

Published Oct 14, 2026 · Updated Oct 15, 2026 · Assigned by TPLink

Vendor: TP-Link Systems Product: RE190 v5 Product: RE200 v5 Product: RE205 v4 Product: RE215 v1 Product: RE220 v3 Product: RE230 v2 Product: RE300 v2 Product: RE305 v4 Product: RE315 v1 Product: RE330 v1 Product: RE335 v1 Product: RE365 v2 Product: RE365 v3 Product: RE450 v4.8 Product: RE550 v1 Product: RE750C v4 Category: Network devices

Description

Multiple
TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary
transformation in the HTTP web-management login flow. An unauthenticated attacker
on the same local network who can capture the network traffic associated with
legitimate administrator login may be able to derive an alternative credential
value that produces the same accepted authentication result and use it to
authenticate to the device’s web-management interface with administrator
privileges. Exploitation requires the management login to use HTTP and the
attacker to observe the session key, dictionary, and login value associated
with a legitimate administrator login.

Successful
exploitation may allow an unauthenticated adjacent attacker to gain
administrator access to the affected device and modify exposed configuration
settings.

Affected products

VendorProductAffectedFixed
TP-Link Systems RE190 v5 < V5_260904 V5_260904
TP-Link Systems RE200 v5 < V5_260904 V5_260904
TP-Link Systems RE205 v4 < V4_260904 V4_260904
TP-Link Systems RE215 v1 < V1_260904 V1_260904
TP-Link Systems RE220 v3 < V3_260904 V3_260904
TP-Link Systems RE230 v2 < V2_260904 V2_260904
TP-Link Systems RE300 v2 < V2_260904 V2_260904
TP-Link Systems RE305 v4 < V4_260904 V4_260904
TP-Link Systems RE330 v1 < V1_260904 V1_260904
TP-Link Systems RE335 v1 < V1_260904 V1_260904
TP-Link Systems RE365 v2 < V2_260904 V2_260904
TP-Link Systems RE365 v3 < V3_260904 V3_260904
TP-Link Systems RE750C v4 < V4_260904 V4_260904
TP-Link Systems RE450 v4.8 < V4_260915 V4_260915
TP-Link Systems RE550 v1 < V1_260915 V1_260915
TP-Link Systems RE315 v1 < V1_260904 rel3959 V1_260904 rel3959

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • lukaspalm/CVE-2026-109506 ★ 0 · Oct 14, 2026

    Technical writeup of CVE-2026-109506, a vulnerability I found in multiple TP-Link Wi-Fi Range Extenders

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References