CVE-2026-89052: Hardcoded AES encryption key in Archer C6
A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials.
Successful exploitation may allow unauthorized disclosure of sensitive information, including administrative credentials.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to obtain an encrypted configuration file or other protected credential data from an affected device. The shared cryptographic key can then be used to recover plaintext credentials.
What information could be exposed?
Protected data, including administrative credentials, may be recovered in plaintext. This could enable unauthorized disclosure of sensitive information.
How can I tell whether my device may be affected?
The issue is identified for TP-Link Archer C6 devices. Exposure is relevant where an attacker could obtain an encrypted configuration backup or other protected credential data from the device.