CVE-2026-102813Medium· 6.1▾ SunlitAn authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-res…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password.
Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.
re305_v3 < 1.1.8 Build 20260921 Rel. 42853Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102812Medium· 6.9Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7
CVE-2026-102814High· 8.7Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305
CVE-2026-102816Medium· 5.3Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305
CVE-2026-102815Medium· 6.9Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305
CVE-2026-18330Medium· 6.1A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4
CVE-2026-89052Medium· 5.9Hardcoded AES encryption key in Archer C6