Archer C6 V2
Monthly
TP-Link Archer C6 V2 routers use a device-universal hardcoded cryptographic key to protect exported configuration backups and stored credential data, so anyone who obtains such an encrypted artifact can decrypt it and recover plaintext administrative credentials. This is a moderate-severity confidentiality issue (CVSS 4.0 base 5.9; assessed CVSS 3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) because exploitation requires possession of the encrypted configuration file-typically after an administrative export, backup leak, support/RMA exposure, or prior compromise-rather than direct remote decryption. No public exploit has been identified at time of analysis, and TP-Link has released updated firmware for Archer C6 V2.
TP-Link Archer C6 V2 routers use a device-universal hardcoded cryptographic key to protect exported configuration backups and stored credential data, so anyone who obtains such an encrypted artifact can decrypt it and recover plaintext administrative credentials. This is a moderate-severity confidentiality issue (CVSS 4.0 base 5.9; assessed CVSS 3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) because exploitation requires possession of the encrypted configuration file-typically after an administrative export, backup leak, support/RMA exposure, or prior compromise-rather than direct remote decryption. No public exploit has been identified at time of analysis, and TP-Link has released updated firmware for Archer C6 V2.