High severity8.8NVD Advisory· Published May 22, 2026· Updated Jun 1, 2026

CVE-2026-3294

Description

An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation.

Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

TP-Link/Re305 Firmware
cpe:2.3:o:tp-link:re305_firmware:*:*:*:*:*:*:*:*
Range: <20260515
TP-Link/Re360 Firmware
cpe:2.3:o:tp-link:re360_firmware:*:*:*:*:*:*:*:*
Range: <20260515
TP-Link/Re580d Firmware
cpe:2.3:o:tp-link:re580d_firmware:*:*:*:*:*:*:*:*
Range: <20260515
TP-Link/Re650 Firmware
cpe:2.3:o:tp-link:re650_firmware:*:*:*:*:*:*:*:*
Range: <20260429
TP-Link/Tl Wa860re Firmware
cpe:2.3:o:tp-link:tl-wa860re_firmware:*:*:*:*:*:*:*:*
Range: <20260515
Netgear/WiFi range extendersllm-fuzzy

Patches

Vulnerability mechanics

References

www.tp-link.com/us/support/faq/5101/nvdVendor Advisory
www.tp-link.com/en/support/download/re305/v1/nvdProduct
www.tp-link.com/en/support/download/re360/v1/nvdProduct
www.tp-link.com/en/support/download/re580d/nvdProduct
www.tp-link.com/en/support/download/re650/v1/nvdProduct
www.tp-link.com/en/support/download/tl-wa860re/v4/nvdProduct
www.tp-link.com/us/support/download/re305/v1/nvdProduct
www.tp-link.com/us/support/download/re360/v1/nvdProduct
www.tp-link.com/us/support/download/re580d/nvdProduct
www.tp-link.com/us/support/download/re650/v1/nvdProduct
www.tp-link.com/us/support/download/tl-wa860re/v4/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000