← Back to CVE Explorer

CVE-2026-5363

Full vulnerability record from the local CVENow database.

Description

Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login.  An adjacent attacker with the ability to intercept network traffic could potentially perform a brute-force or factorization attack against the 1024-bit RSA key to recover the plaintext administrator password, leading to unauthorized access and compromise of the device configuration.  This issue affects Archer C7: through Build 20220715.

Severity
MEDIUM
CVSS score
5.4 (v4.0)
Vulnerability status
Analyzed
Source identifier
f23511db-6c3e-4e32-a477-6aa17d310630
Published
2026-04-16 00:16:29.547000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON 
{
  "id": "CVE-2026-5363",
  "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
  "published": "2026-04-16T00:16:29.547",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [
    {
      "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "unsupported-when-assigned"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login. \nAn adjacent attacker with the ability to intercept network traffic could potentially perform a brute-force or factorization attack against the 1024-bit RSA key to recover the plaintext administrator password, leading to unauthorized access and compromise of the device configuration.  This issue affects Archer C7: through Build 20220715."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de fuerza de cifrado inadecuada en TP-Link Archer C7 v5 y v5.8 (módulos uhttpd) permite la explotación para la recuperación de contraseñas. La interfaz web cifra la contraseña de administrador del lado del cliente usando RSA-1024 antes de enviarla al router durante el inicio de sesión. Un atacante adyacente con la capacidad de interceptar el tráfico de red podría potencialmente realizar un ataque de fuerza bruta o de factorización contra la clave RSA de 1024 bits para recuperar la contraseña de administrador en texto plano, lo que lleva a un acceso no autorizado y al compromiso de la configuración del dispositivo. Este problema afecta a Archer C7: hasta la compilación 20220715."
    }
  ],
  "affected": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "affectedData": [
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "Archer C7 v5 and v5.8",
          "defaultStatus": "unaffected",
          "modules": [
            "uhttpd"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "Build 20220715",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-16T13:17:25.657073Z",
          "id": "CVE-2026-5363",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-326"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:tp-link:archer_c7_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.2.1",
              "matchCriteriaId": "EEC8A9A3-E042-4152-9AED-DCF418B94FC2"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:tp-link:archer_c7:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "33EEE609-7209-4402-995B-A09BCA84C9A6"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:tp-link:archer_c7:5.80:*:*:*:*:*:*:*",
              "matchCriteriaId": "351D38AB-71BD-4D45-8F15-BC31E284DCE7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.tp-link.com/us/support/faq/3562/",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Not Applicable"
      ]
    }
  ]
}