Re305 V3
Monthly
Authentication bypass in the TDDP v2 service of the TP-Link RE305 V3 range extender lets an unauthenticated attacker on the same local network forge protocol packets using a fixed, derivable cryptographic key and reach privileged TDDP operations, including functionality that can result in operating-system command execution with root privileges. Only devices running RE305 V3 firmware before 1.1.8 Build 20260921 Rel. 42853 are affected, and exploitation requires the TDDP service to be running and reachable from the attacker's adjacent network segment (CVSS 4.0 8.7 / assessed CVSS 3.1 8.7, AV:A). A vendor patch is available and no public exploit has been identified at time of analysis; the priority label is this_week because the flaw yields full confidentiality, integrity and availability impact once an attacker has local network presence.
The country/region configuration interface of the TP-Link RE305 V3 range extender lacks an authorization check, so anyone who can reach it from the same local network - joined to its Wi-Fi or on the same LAN - can rewrite the wireless regulatory region and force the device to reapply its wireless configuration, with no credentials or user interaction needed. The practical result is limited to wireless availability: interrupted connections, unavailable channels, client disconnections and unstable service, plus operating parameters meant for a different regulatory domain; there is no loss of confidentiality or of device-data integrity. Exploitation is constrained to the adjacent network segment rather than the internet, so exposure depends on who can join that local wireless or wired network. No public exploit code was identified at time of analysis, and TP-Link has released fixed firmware.
OS command injection in the tmpServer/TDDPv1 service of the TP-Link RE305 V3 range extender lets a low-privileged local attacker run arbitrary operating-system commands as root on the device. The service listens only on the local loopback interface, so the attacker must already hold some on-device execution foothold; there is no network-reachable path and no scope change beyond the extender itself. No public exploit code was identified at time of analysis, and TP-Link has released firmware 1.1.8 Build 20260921 Rel. 42853 that removes the flaw, making this a moderate, situational priority (patching this month) rather than an emergency.
Administrator account takeover in TP-Link RE305 V3 Wi-Fi range extenders: the device's unauthenticated password-recovery verification-code interface can be driven by anyone positioned on the same LAN or Wi-Fi to generate an administrator password-reset code, and the code can then be obtained or brute-forced. Two weaknesses enable this - the interface has no effective attempt counter or lockout, and the verification code is produced by a predictable generation process (CWE-338). Exploitation requires an adjacent-network position (the vector is AV:A, so this is not reachable from the internet) and a brute-force or prediction effort (AC:H); no public exploit or PoC has been identified at time of analysis and the CVE is not in CISA KEV. Successful abuse lets the attacker reset the admin password and reach privileged device-management functions, with high integrity impact but limited confidentiality and availability impact.
Hard-coded AES-128 key and IV values in TP-Link RE305 V3 and Archer C7 V5 configuration backups allow anyone who obtains an exported backup file to decrypt it and recover administrator passwords and Wi-Fi credentials. Affected firmware is RE305 V3 before 1.1.8 Build 20260921 Rel. 42853 and Archer C7 V5 before 1.3.1 Build 20260821 Rel. 41256; exploitation requires possession of a backup file and has no remote path against a running device (CVSS 4.0 base 6.9, local vector). Vendor patches are available, and no public exploit was identified in the supplied intelligence at time of analysis.
Authentication bypass in the TDDP v2 service of the TP-Link RE305 V3 range extender lets an unauthenticated attacker on the same local network forge protocol packets using a fixed, derivable cryptographic key and reach privileged TDDP operations, including functionality that can result in operating-system command execution with root privileges. Only devices running RE305 V3 firmware before 1.1.8 Build 20260921 Rel. 42853 are affected, and exploitation requires the TDDP service to be running and reachable from the attacker's adjacent network segment (CVSS 4.0 8.7 / assessed CVSS 3.1 8.7, AV:A). A vendor patch is available and no public exploit has been identified at time of analysis; the priority label is this_week because the flaw yields full confidentiality, integrity and availability impact once an attacker has local network presence.
The country/region configuration interface of the TP-Link RE305 V3 range extender lacks an authorization check, so anyone who can reach it from the same local network - joined to its Wi-Fi or on the same LAN - can rewrite the wireless regulatory region and force the device to reapply its wireless configuration, with no credentials or user interaction needed. The practical result is limited to wireless availability: interrupted connections, unavailable channels, client disconnections and unstable service, plus operating parameters meant for a different regulatory domain; there is no loss of confidentiality or of device-data integrity. Exploitation is constrained to the adjacent network segment rather than the internet, so exposure depends on who can join that local wireless or wired network. No public exploit code was identified at time of analysis, and TP-Link has released fixed firmware.
OS command injection in the tmpServer/TDDPv1 service of the TP-Link RE305 V3 range extender lets a low-privileged local attacker run arbitrary operating-system commands as root on the device. The service listens only on the local loopback interface, so the attacker must already hold some on-device execution foothold; there is no network-reachable path and no scope change beyond the extender itself. No public exploit code was identified at time of analysis, and TP-Link has released firmware 1.1.8 Build 20260921 Rel. 42853 that removes the flaw, making this a moderate, situational priority (patching this month) rather than an emergency.
Administrator account takeover in TP-Link RE305 V3 Wi-Fi range extenders: the device's unauthenticated password-recovery verification-code interface can be driven by anyone positioned on the same LAN or Wi-Fi to generate an administrator password-reset code, and the code can then be obtained or brute-forced. Two weaknesses enable this - the interface has no effective attempt counter or lockout, and the verification code is produced by a predictable generation process (CWE-338). Exploitation requires an adjacent-network position (the vector is AV:A, so this is not reachable from the internet) and a brute-force or prediction effort (AC:H); no public exploit or PoC has been identified at time of analysis and the CVE is not in CISA KEV. Successful abuse lets the attacker reset the admin password and reach privileged device-management functions, with high integrity impact but limited confidentiality and availability impact.
Hard-coded AES-128 key and IV values in TP-Link RE305 V3 and Archer C7 V5 configuration backups allow anyone who obtains an exported backup file to decrypt it and recover administrator passwords and Wi-Fi credentials. Affected firmware is RE305 V3 before 1.1.8 Build 20260921 Rel. 42853 and Archer C7 V5 before 1.3.1 Build 20260821 Rel. 41256; exploitation requires possession of a backup file and has no remote path against a running device (CVSS 4.0 base 6.9, local vector). Vendor patches are available, and no public exploit was identified in the supplied intelligence at time of analysis.