---
id: "CVE-2026-89052"
kind: "vulnerability"
aliases: ["CVE-2026-89052"]
title: "Archer C6 router: shared hardcoded key lets attackers decrypt saved credentials"
severity: "medium"
cvss: 5.9
epss: 0.00238
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["archer-c6", "infrastructure", "routers", "self-hosted", "tp-link"]
not_affected_if: ["other-hardware"]
published_at: "2026-10-21T23:17:30+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:08:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89052", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-89052", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Archer C6 router: shared hardcoded key lets attackers decrypt saved credentials

Archer C6 routers use one cryptographic key shared across all devices, so the key is the same on every unit. An attacker who obtains an encrypted configuration file can decrypt it and recover plaintext credentials, including administrative ones.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89052
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-89052

## From the sources

A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials. 

Successful exploitation may allow unauthorized disclosure of sensitive information, including administrative credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_