{"id":"CVE-2026-102813","kind":"vulnerability","aliases":["CVE-2026-102813"],"related":[],"title":"TP-Link RE305 V3: weak password-recovery codes let attackers reset admin password","description":"An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password. \n\n\n\n\n\nSuccessful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.","summary":"The password-recovery interface on the TP-Link RE305 V3 range extender generates administrator reset codes predictably and has no effective attempt limit or lockout. An unauthenticated attacker on the same local network can guess or brute-force the code, reset the admin password, and then control device management.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["home-router","infrastructure","network-gear","re305","tp-link"],"not_affected_if":["patched-firmware"],"how_to_check":"- Check the firmware version on the device admin page or in the app and compare it with the vendor advisory: unknown\n- Confirm whether the device admin interface is reachable from networks other than your own LAN: unknown","fix":"- Update RE305 V3 firmware to the version the TP-Link advisory names: unknown\n- Until patched, change the admin password and restrict access to the device's management interface to trusted hosts.","status":"open","published_at":"2026-10-27T18:17:29+00:00","first_seen_at":"2026-10-27T18:32:58+00:00","triaged_at":"2026-10-27T18:34:53+00:00","updated_at":"2026-10-27T18:34:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T18:34:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update RE305 V3 firmware to the version the TP-Link advisory names: unknown\n- Until patched, change the admin password and restrict access to the device's management interface to trusted hosts.","reach":"network","title":"TP-Link RE305 V3: weak password-recovery codes let attackers reset admin password","impact":"high","summary":"The password-recovery interface on the TP-Link RE305 V3 range extender generates administrator reset codes predictably and has no effective attempt limit or lockout. An unauthenticated attacker on the same local network can guess or brute-force the code, reset the admin password, and then control device management.","category":"infrastructure","nicknames":[],"who_cares":["tp-link","re305","home-router","network-gear"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker resets admin password and takes over device management functions","analyst_note":"Find the TP-Link advisory and fixed firmware version for RE305 V3 and confirm whether the flaw needs any non-default setting.","how_to_check":"- Check the firmware version on the device admin page or in the app and compare it with the vendor advisory: unknown\n- Confirm whether the device admin interface is reachable from networks other than your own LAN: unknown","needs_analyst":true,"not_affected_if":["patched-firmware"],"who_is_affected":"Owners of TP-Link RE305 V3 range extenders where the password-recovery function is reachable from the local network. Devices that are not on the RE305 V3 model or are patched with the fixed firmware are not affected. The sources do not state whether remote or cloud-managed access changes exposure, so that is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000639,"input_tokens":3398,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102813':18A,21A '-2026':17A,20A 'access':179C 'admin':14A,78B 'administr':48B,120C,159C,175C 'allow':106C,164C 'attack':12A,62B,109C,147C,167C 'attempt':56B,132C 'authent':86C 'brute':72B,152C 'brute-forc':71B,151C 'code':10A,50B,75B,104C,125C,143C,155C 'control':82B 'counter':133C 'cve':16A,19A 'devic':83B,182C 'device-manag':181C 'effect':55B,131C 'exist':88C 'exploit':162C 'extend':46B 'flaw':87C 'forc':73B,153C 'function':94C,184C 'gear':28B 'generat':47B,117C,144C 'guess':69B 'home':23B 'home-rout':22B 'infrastructur':25B 'interfac':37B,105C,128C 'lack':129C 'let':11A 'limit':57B 'link':3A,32B,42B,98C 'local':66B,113C,170C 'lockout':59B,135C 'manag':84B,183C 'may':148C,163C 'mechan':136C 'network':27B,67B,114C,171C 'network-gear':26B 'obtain':149C 'password':8A,15A,35B,79B,92C,122C,160C,176C 'password-recoveri':7A,34B,91C 'password-reset':121C 'predict':51B,140C 'privileg':180C 'process':145C 'rang':45B 're305':4A,29B,43B,99C 'recoveri':9A,36B,93C 'reset':13A,49B,76B,123C,157C,173C 'router':24B 'subsequ':178C 'success':161C 'tp':2A,31B,41B,97C 'tp-link':1A,30B,40B,96C 'trigger':116C 'unauthent':61B,108C,166C 'use':138C 'v3':5A,44B,100C 'verif':103C,124C,142C 'verification-cod':102C,141C 'weak':6A","nicknames":[],"mitigations":[],"who_affected":"Owners of TP-Link RE305 V3 range extenders where the password-recovery function is reachable from the local network. Devices that are not on the RE305 V3 model or are patched with the fixed firmware are not affected. The sources do not state whether remote or cloud-managed access changes exposure, so that is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102813","severity":null,"published_at":"2026-10-27T18:17:29+00:00","modified_at":"2026-10-27T18:17:29+00:00","first_seen_at":"2026-10-27T18:32:58+00:00","fetched_at":"2026-10-27T18:32:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}