Vulnerability · Published Oct 27, 2026 · Assigned by TPLink
CVE-2026-102816Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305
Medium 5.3
In plain English
A medium-severity missing authentication in RE305 v3 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration. Successful exploitation may cause wireless connection interruptions, unavailable channels, client disconnections, or wireless service instability, and may cause the device to apply parameters intended for a different regulatory region.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | RE305 v3 | 0 – before 1.1.8 Build 20260921 Rel. 42853 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N