The Archer C64 firmware v1.0 exposes a debug SSH service that does not enforce authentication rate limiting, a flaw described by CWE‑288 and CWE‑306. Because the SSH server accepts unlimited login attempts and uses the same account credentials as the web interface, an attacker can brute‑force valid administrator credentials. Once authenticated, the attacker gains full control over the router, compromising confidentiality, integrity, and availability of the network managed by the device.

TP‑Link Archer C64 routers running firmware version 1.0 are affected. The flaw is located in the debug SSH sub‑service bundled with this firmware and allows unauthorized credential discovery on devices that have not applied the fix.

The CVSS score of 8.7 signals a high severity risk. The EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker must reach the router’s local or adjacent network to connect to its SSH port and conduct brute‑force attempts against the shared credentials. Because the authentication loop is unlimited, exploitation is technically straightforward in environments where the router is exposed to untrusted or nearby devices, making the risk of compromise significant if no remediation is applied.