TP-Link RE305 CVE-2026-102812

Exploitation requires the attacker to already possess a user-configuration backup file exported from an affected RE305 V3 (before firmware 1.1.8 Build 20260921 Rel. 42853) or Archer C7 V5 (before 1.3.1 Build 20260821 Rel. 41256); the firmware configuration-management component encrypts these backups with a single fixed AES-128 key and IV embedded in the firmware, so once a backup is obtained, decryption is deterministic. The principal limiting factor is backup acquisition - there is no remote network path to trigger this against a running device (AV:L), and the attack succeeds only against backup files produced by vulnerable firmware builds; devices already updated to the fixed builds are not exposed. No authentication against the device is needed to decrypt a captured backup (PR:N).

This is a medium-severity confidentiality issue (vendor CVSS 4.0 base 6.9) rather than a high-urgency remote threat. The vector is decisive: AV:L with VC:H and VI:N/VA:N means there is no network-facing attack against the device itself - the flaw is the offline decryptability of a user-configuration backup, and exploitation hinges entirely on the attacker first obtaining that backup file. Because the AES-128 key and IV are static and embedded in publicly downloadable firmware, key recovery is trivial once a backup is in hand, so AC:L/PR:N/UI:N are consistent with the mechanism. No EPSS score is provided in the input, the CVE is not listed in CISA KEV, and no PoC or exploit reference is present, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month' and a vendor patch is already available. Net: the sensitive data at stake (admin and Wi-Fi credentials) is serious, but realistic risk is gated behind backup-file acquisition, making this an opportunistic/targeted exposure rather than a mass-exploitable emergency.

An attacker who comes into possession of a saved configuration backup file for a vulnerable RE305 V3 or Archer C7 V5 - for example from a user's cloud storage, email attachment, or an insecurely handled file - downloads the matching public firmware, extracts the hard-coded AES-128 key and IV, and decrypts the backup to recover the administrator password and Wi-Fi credentials. The CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that no privileges, user interaction, or network access to the device are needed once the backup is obtained, but possession of that backup is the essential precondition. No public exploit identified at time of analysis.