CVE-2026-18330
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
57/100
Published: 2026-09-03
Modified: 2026-10-27
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
Low Complexity
No Auth
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
None
UI:
None
S:
X
AT:
Present
VC:
High
VI:
Low
VA:
Low
Description
A hard-coded cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5. The same RSA-1024 private key is stored within firmware configuration files and reused across devices. An attacker who obtains the private key and captures an HTTP Web UI login session may use the key to decrypt the administrator password. Successful exploitation may disclose the administrator password captured from an HTTP login session and compromise session confidentiality.