Archer C7 Firmware CVE-2026-5363

Exploitation requires: (1) the attacker must be on the same local network segment (adjacent network, WiFi, or wired LAN) as the Archer C7 router - remote internet-based attacks are not possible; (2) the attacker must be able to capture unencrypted or TLS-unencrypted HTTP traffic (i.e., admin login traffic is not protected by HTTPS), which is true for the default uhttpd configuration; (3) the attacker must successfully factor or obtain the factorization of the specific 1024-bit RSA modulus used by the router, which is computationally hard but feasible if the modulus is previously known or if the attacker uses distributed factorization services; (4) the vulnerability only affects the admin password authentication mechanism during initial login - it does not affect subsequent authenticated session tokens (if any) and does not bypass the requirement to know or crack the password. Non-default configurations that deploy HTTPS with proper certificate validation, or that restrict web interface access to specific IPs, would reduce (but not eliminate) risk. Older firmware versions (through Build 20220715) are affected; patched versions remove weak RSA-1024 encryption in favor of stronger methods (likely HTTPS/TLS or RSA-2048+).

CVSS 5.4 with attack vector Adjacent (AV:A) and high complexity (AC:H) accurately reflects real-world constraints: the attacker must be on the same network segment (WiFi or wired LAN) and must successfully factor a 1024-bit RSA modulus, both non-trivial barriers. However, EPSS score P (Probable) and the public POC availability elevate practical risk because: (1) RSA-1024 factorization is feasible within days using online factorization databases (e.g., Factordb.com contains many 1024-bit keys) or distributed efforts like those that factored RSA-576 and RSA-640 in the 2000s-2010s; (2) adjacent network access is common in enterprise and home networks (WiFi compromise, rogue DHCP, ARP spoofing); (3) the CVSS scope is set to unchanged (S:X or effectively S:U), meaning only the router's admin account is compromised, not the broader network. The high confidentiality impact (VC:H) is correct - the admin password is fully disclosed. This is NOT a network RCE but rather a targeted credential recovery attack; realistic threat actors include disgruntled internal employees, WiFi-adjacent neighbors in multi-tenant housing, or network reconnaissance phases of larger intrusions. The lengthy attack time (AC:H, AT:P) reduces prevalence but does not eliminate risk.

A rogue WiFi client or ARP-spoofing attacker on the same local network passively intercepts HTTP traffic between the user's computer and the Archer C7 router during login. The attacker captures the RSA-encrypted admin password ciphertext and submits it to an online RSA-1024 factorization service (such as Factordb.com) or runs local cryptanalytic tools; within hours to days, the plaintext password is recovered. The attacker then connects to the router's web interface using the recovered credentials and modifies WiFi SSID, password, DNS settings, or opens a backdoor. Publicly available POC code or manual factorization tools (e.g., msieve, GGNFS) lower the technical barrier for semi-skilled attackers.