CVE-2026-18330: fallo de gravedad media en TP-Link Systems Inc. RE305 v3
Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.3%
A hard-coded
cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5.
The same RSA-1024 private key is stored within firmware configuration files and
reused across devices. An attacker who obtains the private key and captures an
HTTP Web UI login session may use the key to decrypt the administrator
password.
Successful
exploitation may disclose the administrator password captured from an HTTP
login session and compromise session confidentiality.
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CVEs relacionadas — TP-Link Systems Inc. RE305 v3
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-102815MEDIUMCommand Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305EPSS 0.6%CVE-2026-102814HIGHImproper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305EPSS 0.4%CVE-2026-102813MEDIUMAdministrator Password Reset Through the Verification-Code Interface in TP-Link RE305EPSS 0.2%CVE-2026-102816MEDIUMUnauthenticated Wireless Regulatory Region Configuration in TP-Link RE305EPSS 0.2%CVE-2026-102812MEDIUMHardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7EPSS 0.1%
Referencias
https://www.tp-link.com/en/support/download/archer-c7/v5/#Firmwarehttps://www.tp-link.com/en/support/download/re305/v3/#Firmwarehttps://www.tp-link.com/us/support/download/archer-c7/v5/#Firmwarehttps://www.tp-link.com/us/support/download/re305/v3/#Firmwarehttps://www.tp-link.com/us/support/faq/5362/