CVE-2026-102813 Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-102813?
CVE-2026-102813 is a medium-severity vulnerability in TP-Link Systems Inc. RE305 v3, published on 27 Oct 2026.
Official description
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password.
Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.
Weakness: CWE-338
Which versions are affected by CVE-2026-102813?
How do I fix CVE-2026-102813?
No fix has been published for CVE-2026-102813 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-102813 being exploited?
There is no known exploitation of CVE-2026-102813 in the wild and no public exploit code.
Sources
Also known as GHSA-9q5p-8p59-jhwp.