PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3294 TP-Link Systems Inc. CVE debrief

An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation grants full administrative control of the affected device, with potential impacts to confidentiality, integrity, and availability. The vulnerability carries a CVSS 4.0 score of 8.7 (HIGH severity) with an attack vector of adjacent network, low attack complexity, and no privileges or user interaction required. The weakness is categorized as CWE-20 (Improper Input Validation). Multiple affected models are referenced including RE305, RE360, RE580D, RE650, and TL-WA860RE range extenders. The CVE was published on 2026-05-22 and last modified on 2026-05-26; it currently remains in 'Awaiting Analysis' status per NVD. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA KEV.

Vendor
TP-Link Systems Inc.
Product
Archer RE650 v1
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-05-26
Advisory published
2026-05-22
Advisory updated
2026-05-26

Who should care

Network administrators deploying TP-Link range extenders in enterprise, small business, or home office environments; security teams responsible for IoT device management; and individuals using affected TP-Link range extender models who need to maintain administrative control over their network infrastructure.

Technical summary

The vulnerability exists in the authentication logic of TP-Link range extender firmware, where insufficient validation of login parameters allows an unauthenticated attacker on an adjacent network to manipulate requests and reset the administrator password. The CVSS 4.0 score of 8.7 reflects high impacts to confidentiality, integrity, and availability with adjacent network attack vector, low complexity, and no required privileges or user interaction. The weakness stems from improper input validation (CWE-20). Affected models include RE305 v1, RE360 v1, RE580D, RE650 v1, and TL-WA860RE v4 per referenced firmware download pages.

Defensive priority

HIGH

Recommended defensive actions

  • Review TP-Link security advisories and firmware release notes for affected range extender models
  • Apply latest firmware updates from TP-Link for RE305, RE360, RE580D, RE650, and TL-WA860RE models
  • Segment IoT and range extender devices to restrict adjacent network access
  • Monitor for unauthorized administrative access attempts on TP-Link range extender management interfaces
  • Disable remote management features on range extenders if not required
  • Implement network access controls to limit which devices can reach range extender administrative interfaces

Evidence notes

CVSS 4.0 vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Weakness: CWE-20 (Improper Input Validation). Affected products identified through firmware download references: RE305 v1, RE360 v1, RE580D, RE650 v1, TL-WA860RE v4. Vendor attribution based on reference domain evidence with low confidence; review recommended.

Official resources

2026-05-22