CVE-2026-109506: CWE-287 Improper Authentication in TP-Link Systems Inc. RE190 v5

This vulnerability involves a weak authentication mechanism in TP-Link RE190 v5 devices, where a reversible XOR-and-dictionary transformation is used in the HTTP login process. An attacker on the local network who can capture network traffic from a legitimate administrator login session may compute alternative credentials that authenticate successfully. The attack requires the login session to be unencrypted (HTTP) and the attacker to observe specific session parameters. This flaw allows unauthorized administrator access to the device's web-management interface, enabling configuration changes.

An unauthenticated attacker on the same local network can gain administrator-level access to the affected TP-Link RE190 v5 device by deriving alternative credentials from captured login traffic. This access allows the attacker to modify exposed configuration settings, potentially compromising device security and network integrity. The vulnerability requires the management interface to be accessed over HTTP, not HTTPS.

No official patch or fix is currently documented for this vulnerability. Since exploitation requires the management interface to use HTTP, a recommended mitigation is to configure the device to use HTTPS for web-management login if supported. Additionally, restricting local network access to the management interface can reduce exposure. Check the vendor advisory for any updates on patches or official remediation.