CVE-2026-102813
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code; the lack of an effective attempt counter or lockout and a predictable code generation process may allow obtaining or brute-forcing the code.
Risk Assessment
An unauthenticated attacker on the local network may reset the administrator password and subsequently access privileged device-management functions.
Recommendation
Update TP-Link RE305 V3 firmware to the patched version and restrict access to the management interface from the local network.
Other vulnerabilities in TP-Link RE305 V3
See all- CVE-2026-102816Medium
An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration.
- CVE-2026-102815Medium
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface; a local attacker with access to a low-privileged process may submit a crafted request to the TDDPv1 service and execute OS commands with root privileges.
Original NVD description (English source)
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password. Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS