This vulnerability (CVE-2026-3294) in TP-Link Archer RE650 v1 involves improper input validation (CWE-20) in the authentication logic. An attacker without any privileges can manipulate a login parameter remotely from an adjacent network to reset the administrator password. This leads to complete administrative access to the device. The CVSS 4.0 base score is 8.7, reflecting high severity with attack vector being adjacent network, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor has not published any patch or remediation information, and the device is not a cloud service.

Successful exploitation results in full administrative control of the affected TP-Link Archer RE650 v1 device. This compromises the device's confidentiality, integrity, and availability, potentially allowing an attacker to alter configurations, intercept or disrupt network traffic, and deny legitimate access. The vulnerability can be exploited remotely from an adjacent network without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device from untrusted adjacent networks and monitor for unauthorized access attempts. Avoid exposing the device management interface to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.