Vulnerability · Published May 22, 2026 · Assigned by TPLink

CVE-2026-3294Authentication Logic Vulnerability on Multiple TP-Link Range Extenders

High 8.7

In plain English

A high-severity improper input validation in Archer RE305 v1 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 65.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	Archer RE650 v1	0 – before V1_20260429
TP-Link Systems Inc.	Archer RE305 v1	0 – before V1_20260515
TP Link Systems Inc.	Archer RE360 v1	0 – before V1_20260515
TP-Link Systems Inc.	TL-WA860RE v4	0 – before V4_20260515
TP-Link Systems Inc.	RE580D v1	0 – before V1_20260515

Weakness: CWE-20 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References