Three popular TP-Link networking devices were shipped with cryptographic keys that are identical on every unit, and anyone who learns those keys can turn a captured login or a saved configuration file back into the administrator password. TP-Link has published firmware fixes for the Archer C6 and Archer C7 routers and the RE305 range extender, and the Hong Kong Computer Emergency Response Team flagged the batch on 5 November.
The fixes are not brand new. TP-Link's own advisories went up on 21 October (Archer C6) and 27 October (Archer C7 and RE305), so devices that have not been updated since then are still exposed. TP-Link does not say any of the flaws are being exploited, and it credits no researcher.
One key for every box is the core problem
Encryption only protects data if the key is secret. In these devices it was not, because the same key was baked into every unit of a model, so a key learned from one device works against the others.
- Archer C6 V2 (CVE-2026-89052, CVSS v4.0 5.9): TP-Link says the router uses "a universal cryptographic key shared across devices", so an attacker who obtains an encrypted configuration file or other protected credential data can recover the plaintext credentials, including administrative ones.
- Archer C7 V5 and RE305 V3 (CVE-2026-18330, CVSS v4.0 6.1): a hardcoded, shared RSA-1024 private key in the web login. TP-Link says it could let an attacker decrypt an administrator password captured from an HTTP login session.
- Archer C7 V5 and RE305 V3 (CVE-2026-102812, CVSS v4.0 6.9): configuration backups are encrypted with a hardcoded AES-128 key and a fixed initialisation value, exposing administrator passwords and Wi-Fi credentials stored in them.
The range extender carries the worst bug
The RE305 V3 extender picks up four more issues on top of the two key flaws. The most serious, CVE-2026-102814 (CVSS v4.0 8.7, High), is an authentication failure in TP-Link's TDDP v2 service that the vendor says allows an unauthenticated attacker to run commands as root when that service is reachable. The others are an administrator password reset through a verification-code interface with no limit on attempts (CVE-2026-102813, 6.1), a command injection in the tmpServer component that lets a low-privileged local user become root (CVE-2026-102815, 6.9), and an unauthenticated change to the wireless regulatory region that can disrupt Wi-Fi service (CVE-2026-102816, 5.3).
As published on 27 October, TP-Link's advisory lists CVE-2026-102816 against two entries, once with text identical to the tmpServer injection and once for the regulatory-region flaw. Teams that track patches by CVE ID should check the official records rather than rely on that page alone.
Every one of these scores assumes the attacker is already on the same network as the device or holds a file taken from it. TP-Link's vectors rate them as adjacent-network or local attacks, plus one network-vector entry that requires high privileges. That is narrower than a bug anyone on the internet can fire at a router, but home and small-office networks are exactly where a guest, a compromised laptop or a stolen backup file puts an attacker in that position, and router weaknesses are routinely folded into larger campaigns, as the 12-nation warning on FSB router hijacking showed.
Update to the fixed firmware builds
TP-Link lists no workaround, only firmware updates:
- Archer C6 V2: 1.2.1 Build 260902 or later.
- Archer C7 V5: 1.3.1 Build 20260821 Rel. 41256 or later.
- RE305 V3: 1.1.8 Build 20260921 Rel. 42853 or later.
Because the flaws expose stored passwords, updating the firmware is only half the job. Owners who have ever exported a configuration backup, or logged in to the web interface over plain HTTP on a shared network, should change the administrator password and the Wi-Fi passphrase after updating, since anything encrypted under the old shared keys should be treated as readable.
A patched box with a password that leaked last month is still an open door, and with shared keys that is the realistic risk here.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.