Archer C7 V5
Monthly
Hard-coded AES-128 key and IV values in TP-Link RE305 V3 and Archer C7 V5 configuration backups allow anyone who obtains an exported backup file to decrypt it and recover administrator passwords and Wi-Fi credentials. Affected firmware is RE305 V3 before 1.1.8 Build 20260921 Rel. 42853 and Archer C7 V5 before 1.3.1 Build 20260821 Rel. 41256; exploitation requires possession of a backup file and has no remote path against a running device (CVSS 4.0 base 6.9, local vector). Vendor patches are available, and no public exploit was identified in the supplied intelligence at time of analysis.
Hard-coded AES-128 key and IV values in TP-Link RE305 V3 and Archer C7 V5 configuration backups allow anyone who obtains an exported backup file to decrypt it and recover administrator passwords and Wi-Fi credentials. Affected firmware is RE305 V3 before 1.1.8 Build 20260921 Rel. 42853 and Archer C7 V5 before 1.3.1 Build 20260821 Rel. 41256; exploitation requires possession of a backup file and has no remote path against a running device (CVSS 4.0 base 6.9, local vector). Vendor patches are available, and no public exploit was identified in the supplied intelligence at time of analysis.