CVE-2026-5363

Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login. An adjacent attacker with the ability to intercept network traffic could potentially perform a brute-force or factorization attack against the 1024-bit RSA key to recover the plaintext administrator password, leading to unauthorized access and compromise of the device configuration. This issue affects Archer C7: through Build 20220715.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/us/support/faq/3562/	Not Applicable

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tp-link:archer_c7_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:tp-link:archer_c7:5.0:::::::*
	cpe:2.3:h:tp-link:archer_c7:5.80:::::::*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de fuerza de cifrado inadecuada en TP-Link Archer C7 v5 y v5.8 (módulos uhttpd) permite la explotación para la recuperación de contraseñas. La interfaz web cifra la contraseña de administrador del lado del cliente usando RSA-1024 antes de enviarla al router durante el inicio de sesión. Un atacante adyacente con la capacidad de interceptar el tráfico de red podría potencialmente realizar un ataque de fuerza bruta o de factorización contra la clave RSA de 1024 bits para recuperar la contraseña de administrador en texto plano, lo que lleva a un acceso no autorizado y al compromiso de la configuración del dispositivo. Este problema afecta a Archer C7: hasta la compilación 20220715.

Information

Published : 2026-04-16 00:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-5363

Mitre link : CVE-2026-5363

CVE.ORG link : CVE-2026-5363

JSON object : View

Products Affected

tp-link

archer_c7
archer_c7_firmware

CWE

CWE-326

Inadequate Encryption Strength

{"id": "CVE-2026-5363", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5363", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T13:17:25.657073Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "modules": ["uhttpd"], "product": "Archer C7 v5 and v5.8", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "Build 20220715"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-16T00:16:29.547", "references": [{"url": "https://www.tp-link.com/us/support/faq/3562/", "tags": ["Not Applicable"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-326"}]}], "descriptions": [{"lang": "en", "value": "Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation.\u00a0The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login.\u00a0\nAn adjacent attacker with the ability to intercept network traffic could potentially perform a brute-force or factorization attack against the 1024-bit RSA key to recover the plaintext administrator password, leading to unauthorized access and compromise of the device configuration.\u00a0\u00a0This issue affects Archer C7: through Build 20220715."}, {"lang": "es", "value": "Vulnerabilidad de fuerza de cifrado inadecuada en TP-Link Archer C7 v5 y v5.8 (m\u00f3dulos uhttpd) permite la explotaci\u00f3n para la recuperaci\u00f3n de contrase\u00f1as. La interfaz web cifra la contrase\u00f1a de administrador del lado del cliente usando RSA-1024 antes de enviarla al router durante el inicio de sesi\u00f3n. Un atacante adyacente con la capacidad de interceptar el tr\u00e1fico de red podr\u00eda potencialmente realizar un ataque de fuerza bruta o de factorizaci\u00f3n contra la clave RSA de 1024 bits para recuperar la contrase\u00f1a de administrador en texto plano, lo que lleva a un acceso no autorizado y al compromiso de la configuraci\u00f3n del dispositivo. Este problema afecta a Archer C7: hasta la compilaci\u00f3n 20220715."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_c7_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEC8A9A3-E042-4152-9AED-DCF418B94FC2", "versionEndExcluding": "1.2.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_c7:5.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "33EEE609-7209-4402-995B-A09BCA84C9A6"}, {"criteria": "cpe:2.3:h:tp-link:archer_c7:5.80:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "351D38AB-71BD-4D45-8F15-BC31E284DCE7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}