CVE-2026-109506 Details

A vulnerability exists in multiple TP-Link Wi-Fi range extenders due to a custom, reversible XOR-and-dictionary transformation used in the HTTP web-management login process. This flaw allows an unauthenticated attacker on the same local network to capture traffic from legitimate administrator logins and derive alternative credential values that can be used to gain unauthorized access to the device's web-management interface with admin privileges. Exploitation requires the management login to be conducted over HTTP, and the attacker must observe the session key, dictionary, and login value from a real admin login. Successful exploitation could enable the attacker to access admin rights on the device and alter available configuration settings.

Users are advised to update their devices to the latest firmware version that addresses this vulnerability. The specific firmware versions can be found on the TP-Link Download Center.