Inadequate Encryption in TP-Link Router Affects Administrator Password Security

CVE-2026-5363

What is CVE-2026-5363?

The Archer C7 router, particularly versions v5 and v5.8, suffers from an Inadequate Encryption Strength vulnerability due to the use of RSA-1024 in the web interface for encrypting administrator passwords. This client-side encryption method is vulnerable to interception by an adjacent attacker who can monitor network traffic. With sufficient access, an attacker could exploit this to conduct brute-force or factorization attacks on the RSA key, potentially revealing the plaintext administrator password and compromising the router's configuration. Effective security measures are crucial to safeguard against unauthorized access.

References