{"id":"CVE-2026-102812","kind":"vulnerability","aliases":["CVE-2026-102812"],"related":[],"title":"TP-Link Archer and RE305 range extenders: hard-coded backup key exposes passwords","description":"A hard-coded\ncryptographic key vulnerability exists in the user-configuration backup\nmechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and\ninitialization vector are embedded in the firmware configuration-management\ncomponent. An attacker who obtains an affected configuration backup file may\nextract the cryptographic material from the firmware and use it to decrypt the\nbackup. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may disclose sensitive configuration information contained in a\nbackup file, including administrator passwords and Wi-Fi credentials.","summary":"TP-Link RE305 V3 and Archer C7 V5 firmware embeds a fixed AES-128 key and IV for encrypting user configuration backups. An attacker who gets a backup file can extract the key from firmware and decrypt it, exposing admin passwords and Wi-Fi credentials.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["home-network","infrastructure","routers","tp-link","wifi"],"not_affected_if":["no-backup-file-exposed","other-models"],"how_to_check":"- Check the model and hardware version on the device label or admin page: RE305 V3 or Archer C7 V5.\n- Compare the firmware version against the vendor advisory listed in the NVD entry: unknown.","fix":"- Update the RE305 V3 and Archer C7 V5 firmware to a version that fixes the issue: unknown.\n- Change the admin password and Wi-Fi passphrase on any device whose backup file may have been exposed.","status":"open","published_at":"2026-10-27T18:17:29+00:00","first_seen_at":"2026-10-27T18:32:58+00:00","triaged_at":"2026-10-27T18:34:44+00:00","updated_at":"2026-10-27T18:34:44+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T18:34:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the RE305 V3 and Archer C7 V5 firmware to a version that fixes the issue: unknown.\n- Change the admin password and Wi-Fi passphrase on any device whose backup file may have been exposed.","reach":"local","title":"TP-Link Archer and RE305 range extenders: hard-coded backup key exposes passwords","impact":"medium","summary":"TP-Link RE305 V3 and Archer C7 V5 firmware embeds a fixed AES-128 key and IV for encrypting user configuration backups. An attacker who gets a backup file can extract the key from firmware and decrypt it, exposing admin passwords and Wi-Fi credentials.","category":"infrastructure","nicknames":[],"who_cares":["tp-link","routers","wifi","home-network"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker decrypts backup and reads admin passwords and Wi-Fi credentials","analyst_note":"Find the TP-Link advisory and fixed firmware versions for RE305 V3 and Archer C7 V5; the NVD entry gives no version data.","how_to_check":"- Check the model and hardware version on the device label or admin page: RE305 V3 or Archer C7 V5.\n- Compare the firmware version against the vendor advisory listed in the NVD entry: unknown.","needs_analyst":true,"not_affected_if":["other-models","no-backup-file-exposed"],"who_is_affected":"Owners of TP-Link RE305 V3 and Archer C7 V5 devices are affected, since the flaw is in the firmware itself. The risk requires that someone obtains a backup file, so exposure of backups in shared storage or cloud folders raises the concern. Teams that do not run these models can skip it.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":3412,"output_tokens":649,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102812':18A,21A '-128':45B,106C '-2026':17A,20A 'admin':71B 'administr':157C 'ae':44B,105C 'affect':125C 'archer':4A,37B,100C 'attack':55B,121C 'backup':12A,53B,59B,91C,127C,143C,154C 'c7':38B,101C 'code':11A,81C 'compon':119C 'configur':52B,90C,117C,126C,149C 'configuration-manag':116C 'contain':151C 'credenti':77B,163C 'cryptograph':82C,132C 'cve':16A,19A 'decrypt':68B,141C 'disclos':147C 'emb':41B 'embed':112C 'encrypt':50B 'exist':85C 'exploit':145C 'expos':14A,70B 'extend':8A 'extract':62B,130C 'fi':76B,162C 'file':60B,128C,155C 'firmwar':40B,66B,115C,136C 'fix':43B,104C 'get':57B 'hard':10A,80C 'hard-cod':9A,79C 'home':23B 'home-network':22B 'includ':156C 'inform':150C 'infrastructur':25B 'initi':109C 'iv':48B 'key':13A,46B,64B,83C,107C 'link':3A,29B,33B,96C 'manag':118C 'materi':133C 'may':129C,146C 'mechan':92C 'network':24B 'obtain':123C 'password':15A,72B,158C 'rang':7A 're305':6A,34B,97C 'router':26B 'sensit':148C 'success':144C 'tp':2A,28B,32B,95C 'tp-link':1A,27B,31B,94C 'use':138C 'user':51B,89C 'user-configur':88C 'v3':35B,98C 'v5':39B,102C 'vector':110C 'vulner':84C 'wi':75B,161C 'wi-fi':74B,160C 'wifi':30B","nicknames":[],"mitigations":[],"who_affected":"Owners of TP-Link RE305 V3 and Archer C7 V5 devices are affected, since the flaw is in the firmware itself. The risk requires that someone obtains a backup file, so exposure of backups in shared storage or cloud folders raises the concern. Teams that do not run these models can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102812","severity":null,"published_at":"2026-10-27T18:17:29+00:00","modified_at":"2026-10-27T18:17:29+00:00","first_seen_at":"2026-10-27T18:32:58+00:00","fetched_at":"2026-10-27T18:32:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}