CVE-2026-18330

Deferred Deferred - Pending Action

Hard-Coded Cryptographic Key in TP-Link Archer AX55 Web Module

Publication date: 2026-09-03

Last updated on: 2026-10-27

Assigner: TPLink

Description

A hard-coded cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5. The same RSA-1024 private key is stored within firmware configuration files and reused across devices. An attacker who obtains the private key and captures an HTTP Web UI login session may use the key to decrypt the administrator password. Successful exploitation may disclose the administrator password captured from an HTTP login session and compromise session confidentiality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-10-27

Generated

2026-11-08

AI Q&A

2026-09-04

EPSS Evaluated

2026-11-07

NVD

CVE-2026-18330

EUVD

EUVD-2026-70819

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	archer_ax55	4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves a hard-coded cryptographic key in the web module of TP-Link Archer AX55 v4. An attacker on the same local network can capture an HTTP login session and use the known RSA private key to decrypt the administrator password. The session key uses weakened AES encryption, making it easier to compromise session confidentiality.

Detection Guidance

This vulnerability involves a hard-coded cryptographic key in TP-Link Archer AX55 v4. Detection requires checking for the presence of the known shared RSA private key in HTTP login sessions or weak AES session keys. No specific commands are provided in the context to detect this issue.

Impact Analysis

An attacker could gain access to the administrator password and potentially take control of the router. This could lead to network compromise, unauthorized access to connected devices, or interception of sensitive data transmitted through the router.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using this router may fail compliance audits due to insufficient data protection measures.

Mitigation Strategies

Immediately update the TP-Link Archer AX55 v4 firmware to the latest version to remove the hard-coded cryptographic key. Disable HTTP login sessions and enforce HTTPS for all administrative access to prevent session interception.

Hi! I’m here to help you understand CVE-2026-18330. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...