TP-Link has released new firmware versions that fix six security vulnerabilities in the RE305 range extender, commonly used in home networks, and the Archer C7 router. According to the company’s security advisory dated October 27, all of the vulnerabilities affect the V3 hardware version of the RE305, while two of them affect the Archer C7 V5 model. So the first step in figuring out whether you need the update is to check the hardware version printed on the label under the device.
The most serious vulnerability gives root access from the local network
The highest-scoring entry in the advisory is CVE-2026-102814. The vulnerability, which scores 8.7 on the CVSS 4.0 scale, is in the device’s TDDP v2 service. The service uses a hard-coded cryptographic key that can be derived from the firmware. An unauthenticated attacker on the same local network can use this key to forge protocol packets, access privileged TDDP operations, and execute operating system commands while the service is accessible. TP-Link notes that this can lead to command execution with root privileges.
There are two more local privilege escalation vulnerabilities on the same device. CVE-2026-102815 and CVE-2026-102816 describe command injection in the tmpServer service, which runs as root and listens only on the local loopback interface (6.9). An attacker who has compromised a low-privilege process on the device can gain root privileges by sending a crafted request to the TDDPv1 service. These two are not remote; they only become meaningful when combined with another vulnerability on the device.
Hard-coded keys expose passwords and backups
Two vulnerabilities stem directly from cryptographic mistakes. In CVE-2026-18330, the RSA-1024 private key used for session security in the web interface is hard-coded in the firmware and is the same on all devices. An attacker who extracts the key from the firmware can decrypt the password if they capture an administrator login made over HTTP (6.1).
CVE-2026-102812 concerns the configuration backup. The backup file is encrypted with a hard-coded AES-128 key and a hard-coded initialization vector (6.9). Anyone who obtains the backup file can extract the same information from the firmware and open the file. It contains the administrator password and the Wi-Fi password. This is a silent risk for users who think they have safely stored a backup somewhere.
There is also a problem in the password reset flow. According to CVE-2026-102813, the verification code interface has no effective attempt counter or lockout mechanism, and the code is generated in a predictable way (6.1). An unauthenticated attacker on the local network can crack the code, reset the administrator password, and then access privileged management functions.
Wireless region setting requires no authentication
The sixth entry, CVE-2026-102816, describes a missing authorization check in the country and region configuration interface (5.3). An attacker on the same network can change the wireless region and force the device to reapply the configuration. As a result, channels can become unusable, clients can disconnect, or the device can operate with parameters that are invalid for the country it is in.
Updates and recommendations
The fixed versions by model are as follows:
- RE305 V3: 1.1.8 Build 20260921 Rel. 42853
- Archer C7 V5: 1.3.1 Build 20260821 Rel. 41256
The files are available on TP-Link’s RE305 and Archer C7 download pages. Verify the hardware version before installing. Versions other than V3 or V5 are not covered by this advisory, and this firmware should not be installed on those devices. If you cannot update through the interface, you need to download the file and install it manually.
The measures you can take until the patch is applied are limited but useful. Connect to the management interface over HTTPS, keep remote management disabled, and choose a long administrator password that is different from the default. Do not keep configuration backups in cloud shares or email attachments. In a home where unknown devices, guest Wi-Fi clients, and IoT devices can connect to the local network, many of these vulnerabilities become directly usable.
None of the six CVEs appear on CISA’s list of actively exploited vulnerabilities, and the advisory does not mention any observed exploitation. Still, this kind of authentication weakness in the TDDP service fits the type of target IoT botnets have been hunting for years.
Source: TP-Link Security Advisory · NVD
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.