TP-Link Range Extenders EUVD-2026-101602

Exploitation requires ALL of the following concrete conditions: (1) the device's web-management login must be served over HTTP (not HTTPS) so traffic is observable in cleartext; (2) the attacker must have an adjacent network position - connected to the same local/Wi-Fi network as the extender (AV:A); and (3) the attacker must passively observe a legitimate administrator login and capture its associated session key, dictionary, and login value (UI:P - the attack depends on a real admin authenticating while the attacker is watching). Limiting factors that reduce realistic risk: high attack complexity (AC:H) because the attacker must successfully capture and reverse the XOR-and-dictionary transformation from a captured session; dependency on HTTP being in use (HTTPS or a management session the attacker cannot observe defeats it); and the need for timing coincidence with a genuine admin login rather than on-demand triggering.

This is a medium-severity authentication bypass (CWE-287) rated CVSS 4.0 5.9, and the real-world risk is constrained rather than acute. The vendor's CVSS 4.0 vector (AV:A/AC:H/AT:N/PR:N/UI:P) tells a consistent story: exploitation is NOT remote-internet - it requires an adjacent (same-local-network) position, high attack complexity, and passive user interaction (the attacker must observe a legitimate administrator login over HTTP and capture the session key, dictionary, and login value). PR:N confirms the attacker needs no prior credentials, but the AC:H + UI:P + AV:A combination means the attacker must already be on the LAN and must wait for/observe a real admin authentication, which sharply limits opportunistic mass exploitation. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (no conflict between CVSS and description). One notable gap: the vendor vector sets VI:N (no integrity impact) even though the description explicitly states a successful attacker can 'modify exposed configuration settings,' which implies an integrity impact - this discrepancy should be verified with TP-Link. Overall this is a legitimate but situational flaw best prioritized for networks where untrusted devices share the LAN with the extender, not a drop-everything internet-facing emergency.

An attacker already connected to the same Wi-Fi/LAN as a TP-Link range extender passively captures the HTTP web-management traffic of a legitimate administrator logging in. Because the login uses a reversible XOR-and-dictionary transformation over HTTP, the attacker derives an alternative credential value that the device accepts as equivalent, then authenticates to the web-management interface with administrator privileges. No public exploit code was identified in the provided data, and success depends on catching a real admin login in cleartext HTTP.