Improper HTTP Login Authentication in TP-Link Wi-Fi Range Extenders

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device’s web-management interface with administrator privileges. Exploitation requires the management login to use HTTP and the attacker to observe the session key, dictionary, and login value associated with a legitimate administrator login. Successful exploitation may allow an unauthenticated adjacent attacker to gain administrator access to the affected device and modify exposed configuration settings.

The normalized record marks the default status as unaffected and declares the following affected ranges. TP-Link also lists the corresponding fixed firmware:

• RE190 v5: affected when less than V5_260904; fixed firmware V5_260904.
• RE200 v5: affected when less than V5_260904; fixed firmware V5_260904.
• RE205 v4: affected when less than V4_260904; fixed firmware V4_260904.
• RE215 v1: affected when less than V1_260904; fixed firmware V1_260904.
• RE220 v3: affected when less than V3_260904; fixed firmware V3_260904.
• RE230 v2: affected when less than V2_260904; fixed firmware V2_260904.
• RE300 v2: affected when less than V2_260904; fixed firmware V2_260904.
• RE305 v4: affected when less than V4_260904; fixed firmware V4_260904.
• RE315 v1: affected when less than V1_260904 rel3959; fixed firmware V1_260904 rel3959.
• RE330 v1: affected when less than V1_260904; fixed firmware V1_260904.
• RE335 v1: affected when less than V1_260904; fixed firmware V1_260904.
• RE365 v2: affected when less than V2_260904; fixed firmware V2_260904.
• RE365 v3: affected when less than V3_260904; fixed firmware V3_260904.
• RE750C v4: affected when less than V4_260904; fixed firmware V4_260904.
• RE450 v4.8: affected when less than V4_260915; fixed firmware V4_260915.
• RE550 v1: affected when less than V1_260915; fixed firmware V1_260915.

Firmware releases or parallel branches not listed above have not been independently verified.

The CWE-287 weakness is in the HTTP web-management login flow of affected TP-Link Wi-Fi range extenders. The devices use a custom, reversible XOR-and-dictionary transformation to process the login value. An unauthenticated attacker on the same local network can observe the session key, dictionary, and login value from a legitimate administrator login, then derive an alternative credential value that the device accepts with the same authentication result. The alternative value can be supplied to the login flow to obtain administrator privileges without knowing the original valid credential. The documented precondition is that management login uses HTTP and that the attacker can observe traffic from a legitimate administrator login. The complete transformation algorithm, additional request fields, and internal comparison logic are not disclosed in the available evidence.

• The flaw can be reached by an unauthenticated attacker on the same local network as the affected device; the available evidence does not describe direct Internet reachability.
• The attacker does not need prior privileges on the device, but must observe a legitimate administrator login that uses HTTP.
• Exploitation has high complexity because the attacker must obtain the relevant session key, dictionary, and login value from a valid login session.
• User interaction is passive: a legitimate administrator must perform a login that creates traffic observable by the attacker.
• The current record reports no known exploitation and does not report a public exploit. This status does not prove that exploitation is impossible or absent.

Successful exploitation can turn unauthenticated adjacent access into administrator privileges on the device web interface. The confirmed technical result is administrator authentication and the ability to modify configuration settings exposed by the device. This may expose configuration information or alter device connectivity, depending on the available management functions. The direct scope is the affected device; the available evidence does not establish arbitrary code execution, operating system compromise, lateral movement to other devices, or an inherent availability impact.

• Successful exploitation may give an unauthenticated adjacent attacker administrator access to the affected device.
• Administrator access may expose device configuration information and permit changes to settings made available by the web-management interface.
• Unauthorized configuration changes could alter device connectivity or network behavior, but the advisory does not identify the specific settings that would be affected.
• The confirmed scope is the affected device and its management interface. The record does not establish a breach, compromise of other systems, arbitrary code execution, or service disruption.

1. Inventory each device to identify the exact model, hardware revision, and current firmware. Include every model listed in affected_summary.
2. Update each model to the exact firmware TP-Link lists as fixed:

• RE190 v5, RE200 v5: V5_260904.
• RE205 v4: V4_260904.
• RE215 v1: V1_260904.
• RE220 v3: V3_260904.
• RE230 v2, RE300 v2: V2_260904.
• RE305 v4: V4_260904.
• RE315 v1: V1_260904 rel3959.
• RE330 v1, RE335 v1, RE750C v4: V1_260904, V1_260904, and V4_260904, respectively.
• RE365 v2: V2_260904; RE365 v3: V3_260904.
• RE450 v4.8: V4_260915.
• RE550 v1: V1_260915.

1. After updating, verify that the installed firmware matches the fixed firmware for the correct hardware revision. Do not infer that later releases or other branches are covered unless TP-Link or the affected data explicitly confirms them.
2. If immediate updating is not possible, treat the device as exposed when administrator login uses HTTP and use only a workaround documented by TP-Link, if one exists. The available advisory does not specify a confirmed workaround that replaces the firmware update.
3. Review administrator sessions and configuration changes after remediation for unauthorized activity. The absence of suspicious log evidence does not prove that the device was not exploited.

1. Inventory deployed TP-Link Wi-Fi range extenders and record each model, hardware revision, and running firmware.
2. Compare every device with the affected and fixed boundaries in affected_summary; do not treat unlisted branches or releases as verified safe.
3. Determine whether the device management interface uses HTTP for administrator login. This is an exploitation condition stated by the vendor.
4. Review administrator login records and configuration changes for unusual sessions, especially following HTTP logins. This is precautionary monitoring, not a confirmed vulnerability-specific IOC.
5. Check for unexpected configuration changes and verify the running firmware after remediation. The supplied record and advisory do not identify a vendor-specific log signature or IOC.