This vulnerability (CVE-2026-3294) in TP-Link Archer RE650 v1 arises from improper input validation (CWE-20) in the authentication logic. An attacker without any privileges and without user interaction can manipulate a login parameter to reset the administrator password. This flaw enables full administrative access to the device, compromising all security properties. The CVSS 4.0 vector indicates the attack requires adjacent network access but no privileges or user interaction, with high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by TP-Link as of now.

Successful exploitation results in complete administrative control over the affected TP-Link Archer RE650 v1 device. This compromises the confidentiality of device settings and data, integrity of configuration, and availability of network services relying on the device. The attacker can reset the administrator password, effectively locking out legitimate administrators and potentially using the device for further malicious activities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict physical and network access to the device, especially from adjacent networks. Monitor for unusual device behavior and consider isolating the device in a segmented network zone to limit exposure.