CVE-2026-102816 Details
Description
An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration. Successful exploitation may cause wireless connection interruptions, unavailable channels, client disconnections, or wireless service instability, and may cause the device to apply parameters intended for a different regulatory region.
An authorization vulnerability has been identified in the country or region configuration interface of the TP-Link RE305 V3 range extender. This vulnerability allows an unauthenticated attacker on the same local network to modify the wireless regulatory region, forcing the device to reapply its wireless settings. Exploitation of this vulnerability could lead to interruptions in the wireless connection, unavailability of channels, disconnections of clients, instability in wireless service, and the application of parameters meant for a different regulatory region.
Users are advised to update to the latest firmware version, which addresses this vulnerability. The updated version can be downloaded from the TP-Link official website for the user's region.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.tp-link.com/en/support/download/re305/v3/#Firmware | TPLink | ProductVendor |
| https://www.tp-link.com/us/support/download/re305/v3/#Firmware | TPLink | ProductVendor |
| https://www.tp-link.com/us/support/faq/5362/ | TPLink | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | TPLink |
Affected Products
| Product | Versions |
|---|---|
| TP-Link RE305 | >= 1.1.5, < 1.1.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | TPLink |