The vulnerability results from a hard‑coded RSA‑1024 private key embedded in the firmware of TP‑Link RE305 v3 and Archer C7 v5. The same private key is stored in firmware configuration files and reused across multiple devices. An attacker who can capture an unencrypted HTTP Web UI login session and who obtains the private key can use it to decrypt the administrator password. Successful exploitation therefore discloses the administrator password and compromises session confidentiality.

TP‑Link Systems Inc. Archer C7 v5 and RE305 v3 routers are affected. No other variants or versions are listed in the supplied data.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of 0.00258 indicates a very low probability of exploitation, but it remains an exploitable vulnerability in the given scenario. The issue is not listed in CISA’s KEV catalog, implying no confirmed widespread exploitation. The likely attack vector is a local network attacker who can intercept the unencrypted HTTP session; the exploit requires only network proximity and the ability to capture traffic, without requiring remote code execution or privileged user access. Once the administrator’s password is revealed, the attacker can take full control of the router.