CVE-2026-109506

Multiple TP-Link Wi-Fi range extenders are vulnerable to improper authentication due to a custom, reversible XOR-and-dictionary transformation used in the HTTP web-management login flow. An unauthenticated attacker on the same local network can derive alternative credential values by capturing ne...