CVE-2026-102813: Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password.
Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker must be on the same local network as the TP-Link RE305 V3. The available information does not indicate that the verification-code interface is exposed to attackers outside the local network.
What does an attacker need to do to take over device administration?
The attacker can trigger generation of a password-reset verification code through the recovery interface, then obtain or brute-force the code because generation is predictable and attempts are not effectively limited. A successful reset lets the attacker set the administrator password and access privileged management functions.
Are deployments affected without prior administrator access?
Yes. Exploitation does not require existing authentication to the device; the password-recovery verification-code interface can be used by an unauthenticated local-network attacker.
How can I tell whether an attacker may have exploited the issue?
Review whether the administrator password was changed unexpectedly and whether privileged device-management access occurred without authorization. The provided information does not identify specific logs, indicators, or device-side detection methods.