CVE-2026-109506

/// Technical description

Multiple

TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary

transformation in the HTTP web-management login flow. An unauthenticated attacker

on the same local network who can capture the network traffic associated with

legitimate administrator login may be able to derive an alternative credential

value that produces the same accepted authentication result and use it to

authenticate to the device’s web-management interface with administrator

privileges. Exploitation requires the management login to use HTTP and the

attacker to observe the session key, dictionary, and login value associated

with a legitimate administrator login.

Successful

exploitation may allow an unauthenticated adjacent attacker to gain

administrator access to the affected device and modify exposed configuration

settings.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References