---
id: "CVE-2026-102812"
kind: "vulnerability"
aliases: ["CVE-2026-102812"]
title: "TP-Link Archer and RE305 range extenders: hard-coded backup key exposes passwords"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["home-network", "infrastructure", "routers", "tp-link", "wifi"]
not_affected_if: ["no-backup-file-exposed", "other-models"]
published_at: "2026-10-27T18:17:29+00:00"
first_seen_at: "2026-10-27T18:32:58+00:00"
updated_at: "2026-10-27T18:34:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102812", "first_seen_at": "2026-10-27T18:32:58+00:00"}]
---

# TP-Link Archer and RE305 range extenders: hard-coded backup key exposes passwords

TP-Link RE305 V3 and Archer C7 V5 firmware embeds a fixed AES-128 key and IV for encrypting user configuration backups. An attacker who gets a backup file can extract the key from firmware and decrypt it, exposing admin passwords and Wi-Fi credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the model and hardware version on the device label or admin page: RE305 V3 or Archer C7 V5.
- Compare the firmware version against the vendor advisory listed in the NVD entry: unknown.

## Fix

- Update the RE305 V3 and Archer C7 V5 firmware to a version that fixes the issue: unknown.
- Change the admin password and Wi-Fi passphrase on any device whose backup file may have been exposed.

## Timeline

- 2026-10-27T18:32:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102812

## From the sources

A hard-coded
cryptographic key vulnerability exists in the user-configuration backup
mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and
initialization vector are embedded in the firmware configuration-management
component. An attacker who obtains an affected configuration backup file may
extract the cryptographic material from the firmware and use it to decrypt the
backup. 









Successful
exploitation may disclose sensitive configuration information contained in a
backup file, including administrator passwords and Wi-Fi credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_