An authentication flaw in the password-recovery functionality of TP-Link RE305 V3 allows an unauthenticated attacker on the same local network to generate and potentially brute-force an administrator password-reset verification code. The lack of an effective attempt counter or lockout mechanism combined with a predictable code generation process enables resetting the administrator password and gaining privileged device management access.