cryptographic key vulnerability exists in the user-configuration backup
mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and
initialization vector are embedded in the firmware configuration-management
component. An attacker who obtains an affected configuration backup file may
extract the cryptographic material from the firmware and use it to decrypt the
backup.
Successful
exploitation may disclose sensitive configuration information contained in a
backup file, including administrator passwords and Wi-Fi credentials.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | RE305 v3 | unaffected |
|
||||||
| TP-Link Systems Inc. | Archer C7 v5 | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 27 Oct 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration backup file may extract the cryptographic material from the firmware and use it to decrypt the backup. Successful exploitation may disclose sensitive configuration information contained in a backup file, including administrator passwords and Wi-Fi credentials. | |
| Title | Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7 | |
| Weaknesses | CWE-321 | |
| References |
|
|
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: TPLink
Published:
Updated: 2026-10-27T17:40:13.729Z
Reserved: 2026-09-29T17:18:44.960Z
Link: CVE-2026-102812
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.