Which versions of TP-Link Range Extenders are affected by CVE-2026-3294?

TP-Link Wi-Fi range extenders (Archer RE650/RE305/RE360 v1, TL-WA860RE v4, RE580D v1) contain an authentication bypass vulnerability allowing unauthenticated attackers on the local network to gain…. A patch is available.

How to fix or mitigate CVE-2026-3294?

Within 24 hours, identify and inventory all affected TP-Link range extender models (Archer RE650, RE305, RE360 v1, TL-WA860RE v4, RE580D v1) across your network and check the current firmware versions via device admin interfaces. Within 7 days, apply the vendor-released security patch to all affected devices by downloading the latest firmware from TP-Link support portal and performing firmware updates per vendor instructions; prioritize devices on critical network segments and remote/branch office locations. Within 30 days, complete patching of all remaining devices and implement network segmentation controls to restrict range extender management access to authorized administrator networks only, reducing the window of exposure for any devices awaiting patch deployment.

TP-Link Range Extenders CVE-2026-3294

Q: What is the CVSS score of CVE-2026-3294?

CVE-2026-3294 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31502 HIGH

Improper Input Validation (CWE-20)

2026-05-22 TPLink

GHSA-x4px-5wq7-9jm8

Information Disclosure TP-Link Archer Re650 V1 Archer Re305 V1 Archer Re360 V1 Tl Wa860Re V4 Re580D V1 Tp Link Systems Inc

8.7

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Adjacent unauthenticated attacker with no user interaction gains full admin control, giving AV:A/PR:N/UI:N and high C/I/A; scope unchanged as impact stays within the device.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:23 vuln.today

CVE Published

May 22, 2026 - 20:48 cve.org

HIGH 8.7

CVE Published

May 22, 2026 - 20:48 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation.

Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability.

AnalysisAI

Administrative password reset in multiple TP-Link Wi-Fi range extenders (Archer RE650/RE305/RE360 v1, TL-WA860RE v4, RE580D v1) lets an unauthenticated attacker on the adjacent wireless/LAN network tamper with a login parameter to bypass authentication and take over the device. The flaw stems from insufficient validation of a client-supplied login parameter, yielding full admin control with no credentials or user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but the vendor has released patched firmware.

Technical ContextAI

The affected devices are consumer/SOHO Wi-Fi range extenders that run TP-Link's embedded web management interface for setup and administration. The root cause is classified as CWE-20 (Improper Input Validation): the authentication routine trusts a client-controllable login parameter without adequately validating it, so an attacker can manipulate that value to drive a password-reset code path and set a new administrator password. The affected CPEs are enumerated as tp-link_systems_inc. archer_re650_v1, archer_re305_v1, archer_re360_v1, tl-wa860re_v4, and re580d_v1, indicating the vulnerability spans several distinct hardware models sharing similar firmware logic rather than a single product line.

RemediationAI

Apply the vendor-released patched firmware for each affected model: TL-WA860RE v4 V4_20260515 or later, Archer RE650 v1 V1_20260429 or later, RE580D v1 V1_20260515 or later, Archer RE360 v1 V1_20260515 or later, and Archer RE305 v1 V1_20260515 or later, downloaded from the TP-Link support pages (https://www.tp-link.com/us/support/download/re650/v1/#Firmware and the corresponding re305/re360/tl-wa860re/re580d pages) and per the advisory at https://www.tp-link.com/us/support/faq/5101/. Because the attack requires network adjacency, until firmware is applied reduce exposure by securing the extender's wireless with strong WPA2/WPA3 and a non-shared passphrase so untrusted clients cannot reach the management interface (trade-off: does not help on shared/guest networks), restricting the admin web UI to trusted management hosts/VLANs where the device supports it, and disabling remote/WAN management if enabled; note these are mitigations that limit reachability, not fixes for the underlying validation flaw.