# CVE-2026-102812: Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7

Status: published. Published: 2026-10-27. Updated: 2026-11-04.

A hard-coded
cryptographic key vulnerability exists in the user-configuration backup
mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and
initialization vector are embedded in the firmware configuration-management
component. An attacker who obtains an affected configuration backup file may
extract the cryptographic material from the firmware and use it to decrypt the
backup. 









Successful
exploitation may disclose sensitive configuration information contained in a
backup file, including administrator passwords and Wi-Fi credentials.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/us/support/download/re305/v3/#Firmware
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/en/support/download/re305/v3/#Firmware
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/en/support/download/archer-c7/v5/#Firmware
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/us/support/download/archer-c7/v5/#Firmware

## Affected products and versions

- TP-Link Systems Inc. / RE305 v3: ≥ 0; < 1.1.8 Build 20260921 Rel. 42853 (affected, custom). Source: CNA: TPLink
- TP-Link Systems Inc. / Archer C7 v5: ≥ 0; < 1.3.1 Build 20260821 Rel. 41256 (affected, custom). Source: CNA: TPLink

## Severity and prioritization

- CVSS 4.0: 6.9 (medium); CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: TPLink

- CVSS 4.0: 6.9 (medium); CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: f23511db-6c3e-4e32-a477-6aa17d310630

- CISA KEV: No listing in collected sources

- EPSS: 0.12% as of 2026-11-04; percentile 1.85%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-321

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.tp-link.com/us/support/download/re305/v3/#Firmware (CNA: TPLink; patch)

- https://www.tp-link.com/en/support/download/re305/v3/#Firmware (CNA: TPLink; patch)

- https://www.tp-link.com/en/support/download/archer-c7/v5/#Firmware (CNA: TPLink; patch)

- https://www.tp-link.com/us/support/download/archer-c7/v5/#Firmware (CNA: TPLink; patch)

- https://www.tp-link.com/us/support/faq/5362/ (CNA: TPLink; vendor-advisory)

- https://www.tp-link.com/en/support/download/archer-c7/v5/#Firmware (f23511db-6c3e-4e32-a477-6aa17d310630)

- https://www.tp-link.com/en/support/download/re305/v3/#Firmware (f23511db-6c3e-4e32-a477-6aa17d310630)

- https://www.tp-link.com/us/support/download/archer-c7/v5/#Firmware (f23511db-6c3e-4e32-a477-6aa17d310630)

- https://www.tp-link.com/us/support/download/re305/v3/#Firmware (f23511db-6c3e-4e32-a477-6aa17d310630)

- https://www.tp-link.com/us/support/faq/5362/ (f23511db-6c3e-4e32-a477-6aa17d310630)

## Provenance

- CNA: TPLink: https://www.cve.org/CVERecord?id=CVE-2026-102812; retrieved 2026-11-04; source updated 2026-11-04

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102812; retrieved 2026-11-04; source updated 2026-11-04

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-102812; retrieved 2026-11-04; source updated Not reported

Revision: 097da87b8aa873053398a3f616f20eaad775715817a02e465ba883c7c508b75c

Canonical: https://y2.dev/cve/CVE-2026-102812

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.