---
id: CVE-2026-109506
title: |-
  Multiple
  TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary
  transformation in the HTTP web-management login flow
summary: >-
  Multiple

  TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary

  transformation in the HTTP web-management login flow. An unauthenticated
  attacker

  on the same local network who can capture the network traffic associated…
severity: none
cwe:
  - CWE-287
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:17:09.820'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109506'
references:
  - url: 'https://www.tp-link.com/en/support/download/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/download/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/faq/5344/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
ingestedAt: '2026-10-14T19:49:57.606Z'
---

## Overview

Multiple
TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary
transformation in the HTTP web-management login flow. An unauthenticated attacker
on the same local network who can capture the network traffic associated with
legitimate administrator login may be able to derive an alternative credential
value that produces the same accepted authentication result and use it to
authenticate to the device’s web-management interface with administrator
privileges. Exploitation requires the management login to use HTTP and the
attacker to observe the session key, dictionary, and login value associated
with a legitimate administrator login.





Successful
exploitation may allow an unauthenticated adjacent attacker to gain
administrator access to the affected device and modify exposed configuration
settings.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.