TP-Link RE305 EUVD-2026-111272

The attacker must hold an adjacent-network position on the same LAN or Wi-Fi as the RE305 V3 - the CVSS AV:A rules out remote internet-based exploitation. The attacker then interacts with the device's unauthenticated password-recovery verification-code interface. Exploitation is enabled by two specific weaknesses named in the description: the absence of an effective attempt counter/lockout mechanism, and a predictable verification-code generation process (CWE-338), which together permit obtaining or brute-forcing the admin reset code. Limiting factors: no authentication is required (PR:N) and no user interaction is needed (UI:N), but the required adjacent-network access and the brute-force/prediction effort (AC:H) constrain realistic exploitation. Applies to RE305 V3 firmware before 1.1.8 Build 20260921 Rel. 42853.

This is a medium-severity, locally-scoped account-takeover flaw rather than a high-urgency internet-facing threat. The vendor-supplied CVSS 4.0 vector (6.1) is driven by AV:A, meaning exploitation requires an adjacent/local network position - not remote internet reachability - and AC:H, reflecting the effort of brute-forcing or predicting the verification code. PR:N confirms no authentication is needed, and the impact is weighted toward integrity (VI:H: full admin password reset) with limited confidentiality (VC:L) and availability (VA:L). No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no quantified exploitation probability. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real but non-emergency priority: successful exploitation yields complete administrative control of the device, but the adjacent-network requirement and brute-force complexity substantially narrow the realistic attacker population to someone already on the same LAN/Wi-Fi. Note the signals are internally consistent (medium CVSS, no active-exploitation signals, monthly priority) - there is no conflict to flag, only the absence of EPSS/KEV/PoC data, whose absence is not itself evidence of low risk.

An attacker who has joined the same local network as the RE305 V3 (for example an open or compromised Wi-Fi segment) invokes the unauthenticated password-recovery verification-code interface to trigger an administrator reset code. Because there is no effective attempt counter or lockout and the code generation is predictable, the attacker brute-forces or predicts the code, resets the admin password, and gains privileged device management access. No public exploit was identified in the provided sources.