6.1
MediumCVSS 4.0 · from TPLink
CVE-2026-102813
Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305
RE305 v3 · CWE-338 · CWE-338AffectedRE305 v3
FixUpdate to 1.1.8 Build 20260921 Rel. 42853 or newer
PublishedOct 27, 17:40 · TPLink
ScoredOct 27 · 6.1 · TPLink
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker has to be on the same network. CVSS: adjacent network.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can change data. CVSS impact.
Description
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password. Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.
From TPLink
Affected and fixed versions
ProductAffectedFixed inRE305 v3before 1.1.8 Build 20260921 Rel. 428531.1.8 Build 20260921 Rel. 42853
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known