What’s Vulnerable › Vulnerabilities
CVE-2026-5363: Use of weak cryptographic key in TP-Link Archer C7
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-16 · updated 2026-10-26
- Weakness: CWE-326
Description
Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login. An adjacent attacker with the ability to intercept network traffic could potentially perform a brute-force or factorization attack against the 1024-bit RSA key to recover the plaintext administrator password, leading to unauthorized access and compromise of the device configuration. This issue affects Archer C7: through Build 20220715.
Affected products
- TP-Link Systems Inc. Archer C7 v5 and v5.8: before 1.2.1 — fixed in 1.2.1
How to fix
Upgrade to a fixed version: TP-Link Systems Inc. Archer C7 v5 and v5.8 1.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-5363 or the next vulnerability affects your stack