Multiple TP‑Link Wi‑Fi range extenders implement a custom reversible XOR‑and‑dictionary translation in the HTTP web‑management login process. An attacker who can observe the local network traffic during a legitimate administrator login may reconstruct an alternate credential that maps to the same authentication token. With that credential, the attacker can authenticate as an administrator to the device’s web management interface, enabling the execution of any configuration changes and potentially compromising the Wi‑Fi network.

TP‑Link Systems Inc. Wi‑Fi repeaters in the following models and firmware versions are affected: RE190 v5, RE200 v5, RE205 v4, RE215 v1, RE220 v3, RE230 v2, RE300 v2, RE305 v4, RE315 v1, RE330 v1, RE335 v1, RE365 v2, RE365 v3, RE450 v4.8, RE550 v1, RE750C v4.

The CVSS score of 5.9 indicates a medium severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires the attacker to be on the same local network, capture HTTP traffic during an admin login, and reconstruct the reverse‑encoded credential. Once achieved, the attacker gains full administrator rights, potentially allowing configuration changes that can disrupt network operations or facilitate lateral movement. The risk is significant for devices exposed to unmanaged LAN traffic.