{"id":"CVE-2026-109506","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-109506","generatedAt":"2026-10-28T04:49:38.669Z","title":"An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use…","description":"Multiple\nTP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary\ntransformation in the HTTP web-management login flow. An unauthenticated attacker\non the same local network who can capture the network traffic associated with\nlegitimate administrator login may be able to derive an alternative credential\nvalue that produces the same accepted authentication result and use it to\nauthenticate to the device’s web-management interface with administrator\nprivileges. Exploitation requires the management login to use HTTP and the\nattacker to observe the session key, dictionary, and login value associated\nwith a legitimate administrator login.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent attacker to gain\nadministrator access to the affected device and modify exposed configuration\nsettings.","published":"2026-10-14T19:17:10.000Z","lastModified":"2026-10-15T20:17:07.000Z","status":"Deferred","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","cvss":{"version":"4.0","score":5.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-287"],"affected":[],"epss":{"score":0.00346,"percentile":0.27968,"date":"2026-10-27","history":[{"date":"2026-10-15","score":0.00346,"percentile":0.26487}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-14T19:17:10.000Z","detail":{"score":"5.9","severity":"MEDIUM","publishedAt":"2026-10-14T19:17:09.820Z"},"summary":"New CVE, medium severity (CVSS 5.9)."}],"references":[{"url":"https://www.tp-link.com/en/support/download/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5344/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-109506","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}