{"id":"CVE-2026-89052","kind":"vulnerability","aliases":["CVE-2026-89052"],"related":[],"title":"Archer C6 router: shared hardcoded key lets attackers decrypt saved credentials","description":"A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials. \n\nSuccessful exploitation may allow unauthorized disclosure of sensitive information, including administrative credentials.","summary":"Archer C6 routers use one cryptographic key shared across all devices, so the key is the same on every unit. An attacker who obtains an encrypted configuration file can decrypt it and recover plaintext credentials, including administrative ones.","severity":"medium","cvss":5.9,"epss":0.00238,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["archer-c6","infrastructure","routers","self-hosted","tp-link"],"not_affected_if":["other-hardware"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-21T23:17:30+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:08:01+00:00","updated_at":"2026-10-25T04:08:01+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:08:01Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Archer C6 router: shared hardcoded key lets attackers decrypt saved credentials","impact":"high","summary":"Archer C6 routers use one cryptographic key shared across all devices, so the key is the same on every unit. An attacker who obtains an encrypted configuration file can decrypt it and recover plaintext credentials, including administrative ones.","category":"infrastructure","nicknames":[],"who_cares":["archer-c6","tp-link","routers","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker decrypts config file and reads plaintext administrative credentials","analyst_note":"Find the affected firmware versions and fixed release from the NVD entry and TP-Link advisory, and confirm whether the attack needs network access or only a stolen configuration file.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["other-hardware"],"who_is_affected":"Owners of TP-Link Archer C6 routers. The sources do not name the affected firmware versions or say whether the exposure requires remote access or only a copy of the configuration file. Teams that do not run Archer C6 hardware can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000568,"input_tokens":3374,"output_tokens":462,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-89052':14A,17A 'across':37B,87C 'administr':65B,116C 'allow':109C 'archer':1A,19B,29B,75C 'archer-c6':18B 'attack':8A,50B,90C 'c6':2A,20B,30B,76C 'configur':55B,95C 'credenti':11A,63B,100C,105C,117C 'cryptograph':34B,69C,84C 'cve':12A,15A 'data':101C 'decrypt':9A,58B 'devic':39B,88C 'disclosur':111C 'due':77C 'encrypt':54B,94C 'everi':47B 'exist':73C 'exploit':107C 'file':56B,96C 'hardcod':5A,68C 'host':25B 'includ':64B,115C 'inform':114C 'infrastructur':21B 'key':6A,35B,42B,70C,85C 'let':7A 'link':28B 'manag':71C 'may':108C 'obtain':52B,92C 'one':33B,66B 'plaintext':62B,104C 'protect':99C 'recov':61B,103C 'router':3A,22B,31B 'save':10A 'self':24B 'self-host':23B 'sensit':113C 'share':4A,36B,86C 'success':106C 'tp':27B 'tp-link':26B 'unauthor':110C 'unit':48B 'univers':83C 'use':32B,80C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Owners of TP-Link Archer C6 routers. The sources do not name the affected firmware versions or say whether the exposure requires remote access or only a copy of the configuration file. Teams that do not run Archer C6 hardware can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89052","severity":null,"published_at":"2026-10-21T23:17:30+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-89052","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89052","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}