Live › vulnerability › CVE-2026-89052
Go to dashboardArcher C6 routers use one cryptographic key shared across all devices, so the key is the same on every unit. An attacker who obtains an encrypted configuration file can decrypt it and recover plaintext credentials, including administrative ones.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners of TP-Link Archer C6 routers. The sources do not name the affected firmware versions or say whether the exposure requires remote access or only a copy of the configuration file. Teams that do not run Archer C6 hardware can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials.
Successful exploitation may allow unauthorized disclosure of sensitive information, including administrative credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-89052")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.