TP-Link fixes a login flaw in 16 Wi-Fi range extenders (CVE-2026-109506)

TP-Link published a security advisory on 14 October 2026 for CVE-2026-109506, an authentication flaw in the web management of its RE-series Wi-Fi range extenders. Someone on the same local network who captures a legitimate administrator login can derive a credential that the extender accepts, and log in to its management page with administrator rights. Fixed firmware is out for 16 hardware versions.

How the attack works

According to the advisory, the extenders protect the HTTP login with a custom, reversible XOR-and-dictionary transformation. An attacker who observes the session key, the dictionary and the login value from a real administrator login can compute an alternative value that produces the same accepted result. It does not have to be the original password, but it works like one.

The attack is not easy to pull off. The login must go over HTTP, the attacker has to be on the same local network and has to capture traffic at the moment an administrator actually logs in. That is why TP-Link rates it at 5.9, medium, on CVSS 4.0. The vector marks high complexity, adjacent access and user interaction, with high impact on confidentiality. With administrator access the attacker can change the extender's settings.

Affected models and fixed firmware

The hardware version is usually printed on the label on the device. Firmware updates for the listed models are in TP-Link's download center.

What to do

Install the fixed firmware. Extenders often hang on a socket in a hallway for years without anyone logging in, so it is worth checking even if the network works fine. Until the update is in, avoid logging in to the extender's management page while devices you do not trust are on the same network, such as a guest's phone or a cheap camera you have not isolated. The attack needs exactly that moment.

A guest network or a separate network for IoT devices also limits who counts as "on the same network" in the first place.