Refine your search

2 vulnerabilities found for Archer C7 v5 by TP-Link Systems Inc.

CVE-2026-102812 (GCVE-0-2026-102812)
Vulnerability from cvelistv5
Published
2026-10-27 17:40
Modified
2026-10-27 17:40
Severity ?
6.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-321 - Use of hard-coded cryptographic key
Summary
A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration backup file may extract the cryptographic material from the firmware and use it to decrypt the backup.  Successful exploitation may disclose sensitive configuration information contained in a backup file, including administrator passwords and Wi-Fi credentials.
References
Impacted products
Vendor Product Version
TP-Link Systems Inc. RE305 v3 Version: 0   < 1.1.8 Build 20260921 Rel. 42853
 Create a notification for this product.
   TP-Link Systems Inc. Archer C7 v5 Version: 0   < 1.3.1 Build 20260821 Rel. 41256
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RE305 v3",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "1.1.8 Build 20260921 Rel. 42853",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Archer C7 v5",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "1.3.1 Build 20260821 Rel. 41256",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Victor Mota"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA hard-coded\ncryptographic key vulnerability exists in the user-configuration backup\nmechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and\ninitialization vector are embedded in the firmware configuration-management\ncomponent. An attacker who obtains an affected configuration backup file may\nextract the cryptographic material from the firmware and use it to decrypt the\nbackup.\u0026nbsp;\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSuccessful\nexploitation may disclose sensitive configuration information contained in a\nbackup file, including administrator passwords and Wi-Fi credentials.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "A hard-coded\ncryptographic key vulnerability exists in the user-configuration backup\nmechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and\ninitialization vector are embedded in the firmware configuration-management\ncomponent. An attacker who obtains an affected configuration backup file may\nextract the cryptographic material from the firmware and use it to decrypt the\nbackup.\u00a0\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may disclose sensitive configuration information contained in a\nbackup file, including administrator passwords and Wi-Fi credentials."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321 Use of hard-coded cryptographic key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T17:40:13.729Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/us/support/download/re305/v3/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/re305/v3/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-c7/v5/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/us/support/download/archer-c7/v5/#Firmware"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/us/support/faq/5362/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2026-102812",
    "datePublished": "2026-10-27T17:40:13.729Z",
    "dateReserved": "2026-09-29T17:18:44.960Z",
    "dateUpdated": "2026-10-27T17:40:13.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18330 (GCVE-0-2026-18330)
Vulnerability from cvelistv5
Published
2026-09-03 22:24
Modified
2026-10-27 17:39
Severity ?
6.1 (Medium) - CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-321 - Use of hard-coded cryptographic key
Summary
A hard-coded cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5. The same RSA-1024 private key is stored within firmware configuration files and reused across devices. An attacker who obtains the private key and captures an HTTP Web UI login session may use the key to decrypt the administrator password.  Successful exploitation may disclose the administrator password captured from an HTTP login session and compromise session confidentiality.
References
Impacted products
Vendor Product Version
TP-Link Systems Inc. RE305 v3 Version: 0   < 1.1.8 Build 20260921 Rel. 42853
 Create a notification for this product.
   TP-Link Systems Inc. Archer C7 v5 Version: 0   < 1.3.1 Build 20260821 Rel. 41256
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18330",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T17:39:51.418332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T18:25:58.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RE305 v3",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "1.1.8 Build 20260921 Rel. 42853",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Archer C7 v5",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "1.3.1 Build 20260821 Rel. 41256",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Victor Mota"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA hard-coded\ncryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5.\nThe same RSA-1024 private key is stored within firmware configuration files and\nreused across devices. An attacker who obtains the private key and captures an\nHTTP Web UI login session may use the key to decrypt the administrator\npassword.\u0026nbsp;\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may disclose the administrator password captured from an HTTP\nlogin session and compromise session confidentiality.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "A hard-coded\ncryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5.\nThe same RSA-1024 private key is stored within firmware configuration files and\nreused across devices. An attacker who obtains the private key and captures an\nHTTP Web UI login session may use the key to decrypt the administrator\npassword.\u00a0\n\n\n\n\n\nSuccessful\nexploitation may disclose the administrator password captured from an HTTP\nlogin session and compromise session confidentiality."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321 Use of hard-coded cryptographic key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T17:39:53.630Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/us/support/download/re305/v3/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/re305/v3/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-c7/v5/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/us/support/download/archer-c7/v5/#Firmware"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/us/support/faq/5362/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2026-18330",
    "datePublished": "2026-09-03T22:24:45.430Z",
    "dateReserved": "2026-07-29T20:03:53.524Z",
    "dateUpdated": "2026-10-27T17:39:53.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}