PT-2026-33186 · Tp Link · Archer C7

Sérgio Silva · Published 2026-04-15 · Updated 2026-05-24 · CVE-2026-5363

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link Archer C7 versions v5 and v5.8 through Build 20220715

Description Inadequate encryption strength in the uhttpd modules allows for password recovery exploitation. The web interface encrypts the admin password client-side using RSA-1024 before transmission to the router during login. An adjacent attacker capable of intercepting network traffic could perform a brute-force or factorization attack against the 1024-bit RSA key to recover the plaintext administrator password, potentially leading to unauthorized access and compromise of the device configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2026-5363

Affected Products

Archer C7

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-5363 · Security Note
• https://twitter.com/dailycve/status/2058338574441832737 · Twitter Post
• https://tp-link.com/us/support/faq/3562 · Note
• https://t.me/cveNotify/164651 · Telegram Post
• https://t.me/cveNotify/162350 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2044669152456044839 · Twitter Post
• https://twitter.com/CVEnew/status/2044701599222952006 · Twitter Post