The vulnerability arises from the router’s client‑side login form encrypting the administrator password with a 1024‑bit RSA key before sending it over the network. An attacker who can capture that traffic could use brute‑force or factorization techniques to recover the plaintext password, thereby gaining full administrative control and the ability to modify the device’s configuration. The weakness is classified as inadequate encryption strength (CWE‑326).

TP‑Link Systems Inc. models Archer C7 running firmware versions 5 and 5.8, up to build 20220715.

The CVSS base score of 5.4 indicates moderate severity. Exploitability data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is a network attacker able to intercept traffic between a legitimate client and the router, which could then mount a brute‑force or factorization effort against the weak RSA key. The real‑world risk depends on the attacker’s computational resources and whether the router is exposed to untrusted networks.