The firmware contains hard‑coded DES decryption keys that allow an attacker to decrypt the router’s config.xml file, which contains configuration settings (inferred). This weakness is a classic example of CWE-798, use of hard‑coded credentials.

TP‑Link Archer C20 V5; TP‑Link Archer C50 V3 (up to firmware 180703), V4 (up to 250117), and V5 (up to 200407). Vulnerable C20 V5 firmware is any build older than US_V5_260419 or EU_V5_260317.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score of less than 1% signals a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is that an attacker must interact with the router, most likely via the web interface or through an exposed management protocol, to retrieve and decrypt config.xml (inferred). Based on inference, direct exploitation appears limited if this exposure cannot be achieved (inferred). Nonetheless, the risk warrants timely patching or mitigation to prevent potential configuration compromise.