CVE-2026-5363
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
46/100
Published: 2026-04-16
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
No Auth
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
High
PR:
None
UI:
None
S:
X
AT:
Present
VC:
High
VI:
None
VA:
None
Description
Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login. An adjacent attacker with the ability to intercept network traffic could potentially perform a brute-force or factorization attack against the 1024-bit RSA key to recover the plaintext administrator password, leading to unauthorized access and compromise of the device configuration. This issue affects Archer C7: through Build 20220715.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| tp-link | archer_c7_firmware | < 1.2.1 |
References & Advisories (1)
Not Applicable