Medium severity · published Oct 27, 2026
CVE-2026-102816
Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305
New
5.3
CVSS
–
EPSS
No
On KEV
Description
An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration.  Successful exploitation may cause wireless connection interruptions, unavailable channels, client disconnections, or wireless service instability, and may cause the device to apply parameters intended for a different regulatory region.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RV
RE305 v3 · TP-Link Systems Inc.
before 1.1.8 Build 20260921 Rel. 42853 · source: vendor
Affected product
RV
RE305 v3
TP-Link Systems Inc.
More from RE305 v3
8.7
CVE-2026-102814
Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305
6.9
CVE-2026-102815
Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305
6.9
CVE-2026-102812
Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7
6.1
CVE-2026-102813
Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305
6.1
CVE-2026-18330
Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7