TP-Link Archer C6 CVE-2026-89052

Exploitation requires the attacker to possess the encrypted artifact itself: an exported Archer C6 V2 configuration backup file or other protected credential data stored by the device. The hardcoded, device-universal cryptographic key then decrypts it, exposing plaintext administrative credentials. Limiting factors: the CVSS vector specifies PR:H, so administrative access is normally needed to generate/export the encrypted config, and AT:P reflects the requirement to first acquire that file - a remote, unauthenticated attacker cannot decrypt credentials without obtaining the protected data through a backup leak, support/RMA channel, or prior compromise. Because the key is shared across all devices, once any one config file is obtained the same key decrypts files from every Archer C6 V2 unit.

This is a moderate-severity confidentiality issue (CVSS 4.0 base 5.9) rather than a top-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N) is internally telling: although attack vector is marked Network, it carries both PR:H (high privileges required) and AT:P (a specific attack requirement - the attacker must first obtain the encrypted configuration or protected credential data). Those two gating conditions are what hold the score below 6.0 despite a High confidentiality impact. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood signals are absent: per precision rules this is 'no public exploit identified at time of analysis,' which should NOT be read as proof of safety - it reflects missing data, not confirmed absence of exploit code. The practical risk is bounded: the flaw is a classic hardcoded/universal cryptographic key (CWE-321) that makes any obtained encrypted config trivially decryptable across the entire device fleet, so the real danger materializes only after an attacker already holds the protected file (e.g., via a leaked backup, support upload, or secondary compromise). Note a mild internal tension: AV:N implies remote exploitation, but the description ('obtains an encrypted configuration file ... can recover plaintext credentials') describes an offline cryptographic recovery that in practice requires possession of the file and typically administrative access to export it - verify the realistic access path with TP-Link before treating this as remotely self-contained.

An attacker obtains an encrypted Archer C6 V2 configuration backup or stored credential blob - for example from a leaked router backup file, a device sent for RMA/support, or a secondary network foothold. Because the same hardcoded cryptographic key is baked into every device, the attacker decrypts the file offline and recovers plaintext administrative credentials. No public exploit was identified in the provided data, but the technique requires only the universal key plus the target file.