A hardcoded cryptographic key is embedded in Archer C6 V2, allowing any party that obtains an encrypted configuration file or protected credential data to decrypt it and recover plaintext credentials. This capability enables an attacker to reveal administrative passwords and other sensitive information, effectively compromising account confidentiality.

TP‑Link Archer C6 V2 routers are affected. No other versions or products are listed as vulnerable.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must first acquire the encrypted configuration data, which may be obtained via exposed interfaces or local file access. If an adversary can locate or intercept that data, the decryption step is trivial due to the hardcoded key, leading to credential disclosure.