CVE-2026-109506
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device's web-management interface with administrator privileges. Exploitation requires the management login to use HTTP and the attacker to observe the session key, dictionary, and login value associated with a legitimate administrator login. Successful exploitation may allow an unauthenticated adjacent attacker to gain administrator access to the affected device and modify exposed configuration settings.
Risk Assessment
An attacker on the same network can gain administrator privileges and modify device configuration, potentially leading to network takeover and further attacks.
Recommendation
Disable HTTP management in favor of HTTPS, update TP-Link firmware if a fix is available, and avoid administrative logins over insecure networks.
Related vulnerabilities
- CVE-2026-104736Critical
The LearnPress plugin for WordPress in versions up to and including 4.4.10 is vulnerable to PHP Object Injection via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value passes through sanitize_text_field(), which does not strip serialized object syntax, is stored in the LearnPress session table, and later fed to unserialize() without an allowed_classes restriction.
- CVE-2026-110653Critical
The LatePoint plugin for WordPress in versions up to and including 5.7.4 is vulnerable to Authentication Bypass via Race Condition in the verifyOTP function. The OTP attempts counter is updated non-atomically without a WHERE attempts < 10 guard and without a row lock, creating a TOCTOU window that lets concurrent requests bypass the 10-attempt lockout.
- CVE-2026-111823Critical
Mage OSS through 0.9.80 (before commit 76c4f46) can proceed with session creation upon encountering an unknown OAuth provider. An unknown OAuth provider is not properly rejected, allowing a session to be created.
- CVE-2026-96620Critical
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls.
- CVE-2026-102608Critical
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user.
- CVE-2026-111711Critical
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.
- CVE-2026-111708Critical
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
- CVE-2026-111704Critical
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
- CVE-2026-111693Critical
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.
- CVE-2026-111692Critical
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
Original NVD description (English source)
Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device’s web-management interface with administrator privileges. Exploitation requires the management login to use HTTP and the attacker to observe the session key, dictionary, and login value associated with a legitimate administrator login. Successful exploitation may allow an unauthenticated adjacent attacker to gain administrator access to the affected device and modify exposed configuration settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS