An authorization flaw in the TP‑Link RE305 V3’s country or region configuration interface allows an unauthenticated local‑network attacker to change the wireless regulatory region, forcing the device to reapply its wireless settings. Because the new configuration may be intended for a different regulatory region, this can result in wireless connection interruptions, the disabling of certain channels, client disconnects, or general instability of the wireless service. The vulnerability is classified as CWE‑306 (Authorization Bypass Through User‑Controlled Key).

The affected product is the TP‑Link RE305 V3 router, specifically firmware version 3. No other vendors or product versions are listed as affected.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, so the short‑term exploitation probability cannot be quantified. The device is not listed in the CISA KEV catalog, suggesting there are no reported large‑scale exploits yet. The attack requires the adversary to be on the same local network and to interact with the router’s web management interface. No authentication is required, so the attacker can directly post a new regulatory region value and cause disruptive behavior, which could be used to impair client connectivity or downgrade the network for denial‑of‑service purposes.