An authentication logic flaw in several TP‑Link wireless range extenders lets an unauthenticated attacker on an adjoining network alter a login parameter and reset the device’s administrator password, thereby obtaining full administrative control. The attacker can then read, modify, or stop any traffic handled by the extender, compromising confidentiality, integrity, and availability.

The vulnerability affects TP‑Link devices Archer RE360 v1, Archer RE305 v1, Archer RE650 v1, RE580D v1 and TL‑WA860RE v4, all of which run the original firmware releases listed by the vendor.

The flaw carries a CVSS score of 8.7, indicating high severity, and is not yet listed in the CISA KEV catalog. EPSS data is unavailable, but the attack can be carried out from any adjacent network that can reach the extender’s management interface, requiring no credentials. Once the password is reset, the attacker exploits the full privileged access, making the risk significant for environments where the device is managed remotely or exposed to untrusted networks.