CVE-2026-3294
CWE-20Published: May 22, 2026· Updated: May 26, 2026
Official Description
An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation.
Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability.
Technical Analysis
CVE-2026-3294 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (11)
Quick Facts
Related CVEs (CWE-20)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-3294 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts