Description
A hard-coded
cryptographic key vulnerability exists in the user-configuration backup
mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and
initialization vector are embedded in the firmware configuration-management
component. An attacker who obtains an affected configuration backup file may
extract the cryptographic material from the firmware and use it to decrypt the
backup. 









Successful
exploitation may disclose sensitive configuration information contained in a
backup file, including administrator passwords and Wi-Fi credentials.
Published: 2026-10-27
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Sensitive configuration disclosure
Action: Immediate Patch
AI Analysis

Impact

A hard‑coded cryptographic key and fixed IV are embedded in the firmware of TP‑Link RE305 V3 and Archer C7 V5. An attacker who can access a backup file can retrieve these credentials from the firmware and decrypt the backup, exposing administrative passwords and Wi‑Fi keys.

Affected Systems

TP‑Link Systems Inc. Archer C7 version 5 and RE305 version 3.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires possession of a configuration backup; once the backup is obtained, no additional steps are needed to decrypt it. The risk is significant for users who export or store backups without additional protection, and for environments where backup files could be accessed by an attacker.

Generated by OpenCVE AI on October 27, 2026 at 18:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and install the latest firmware from TP‑Link’s official support site for the affected routers.
  • After updating, recreate and export any configuration backups to ensure they are encrypted with the patched encryption mechanism.
  • Store backup files in an encrypted format and limit physical and network access to protect them from unauthorized retrieval.

Generated by OpenCVE AI on October 27, 2026 at 18:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration backup file may extract the cryptographic material from the firmware and use it to decrypt the backup.  Successful exploitation may disclose sensitive configuration information contained in a backup file, including administrator passwords and Wi-Fi credentials.
Title Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7
Weaknesses CWE-321
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published:

Updated: 2026-10-27T17:40:13.729Z

Reserved: 2026-09-29T17:18:44.960Z

Link: CVE-2026-102812

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T18:17:29.517

Modified: 2026-10-27T18:17:29.517

Link: CVE-2026-102812

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T18:30:08Z

Weaknesses
  • CWE-321

    Use of Hard-coded Cryptographic Key