TP-Link RE305 V3 vulnerabilities

An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration.

An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface; a local attacker with access to a low-privileged process may submit a crafted request to the TDDPv1 service and execute OS commands with root privileges.

An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code; the lack of an effective attempt counter or lockout and a predictable code generation process may allow obtaining or brute-forcing the code.