---
id: CVE-2026-102813
title: >-
  Administrator Password Reset Through the Verification-Code Interface in
  TP-Link RE305
summary: >-
  An authentication flaw exists in the password-recovery functionality of
  TP-Link RE305 V3. The verification-code interface allows an unauthenticated
  attacker on the same local network to trigger generation of an administrator
  password-res…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-338
vendor: TP-Link Systems Inc.
product: RE305 v3
affected:
  - re305_v3 < 1.1.8 Build 20260921 Rel. 42853
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T17:40:31.857Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-102813'
references:
  - url: 'https://www.tp-link.com/us/support/download/re305/v3/#Firmware'
  - url: 'https://www.tp-link.com/en/support/download/re305/v3/#Firmware'
  - url: 'https://www.tp-link.com/us/support/faq/5362/'
tags:
  - cve.org
ingestedAt: '2026-10-27T17:54:31.780Z'
---

## Overview

An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password. 





Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.

## Affected

- `re305_v3 < 1.1.8 Build 20260921 Rel. 42853`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.