TP-Link RE305 V3 EUVD-2026-111275

The attacker must have adjacent-network access to the RE305 V3 - connected to its wireless network or the same local LAN (AV:A) - but requires no credentials (PR:N), no user interaction (UI:N), and no special victim-side configuration; the country/region configuration interface itself lacks the authorization check (CWE-306). The primary limiting factor is that this is not internet-remote: an attacker on a different network cannot reach the interface, so exposure depends on who can join the local wireless/wired segment. Impact is further limited to wireless availability/service quality (VA:L) - disconnections, unavailable channels, and application of wrong-region parameters - with no confidentiality or integrity compromise of device data.

This is a genuinely medium/low-priority issue rather than a disguised critical. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms an unauthenticated, low-complexity attack, but the adjacent-network requirement (AV:A) means the attacker must already be on the same LAN/WLAN as the RE305, which sharply limits the exploit population versus a remote (AV:N) flaw. Impact is confined to availability (VA:L; VC:N/VI:N), so this is a wireless-disruption/denial-of-service-of-service-quality issue, not code execution or data exposure, consistent with the 5.3 base score. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit or PoC reference is present in the input, so there is no public exploit identified at time of analysis. The vendor-assigned decision label is 'this_month' (not act_now/emergency), aligning with the moderate severity. One minor cross-reference note: the Tags label this 'Authentication Bypass' while the assigned weakness is CWE-306 (Missing Authentication for a Critical Function) and the description frames it as an authorization flaw on the region-config interface - these are closely related framings of the same missing-access-control root cause, not a conflict that changes the risk. Overall: a real but bounded, locally-scoped availability weakness; patch within normal cycles rather than as an emergency.

An attacker who has joined the RE305 V3's local network (for example by connecting to its Wi-Fi) sends a request to the unauthenticated country/region configuration interface to change the wireless regulatory region. The device accepts the change without authorization and reapplies its wireless configuration, dropping connected clients and potentially disabling channels. No public exploit code is identified at time of analysis.