{"id":"CVE-2026-18330","title":"A hard-coded\ncryptographic key vulnerability exists in the web module of TP-Link Archer\nAX55 v4","summary":"A hard-coded\ncryptographic key vulnerability exists in the web module of TP-Link Archer\nAX55 v4. A LAN attacker who captures an HTTP login session may use the known\nshared RSA private key to decrypt the administrator password; the\nweaken…","severity":"medium","cwe":["CWE-321"],"published":"2026-09-03","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:15:18.627","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18330","references":[{"url":"https://www.tp-link.com/us/support/download/archer-ax55/v4/#Firmware","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5279/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/re305/v3/#Firmware"},{"url":"https://www.tp-link.com/en/support/download/re305/v3/#Firmware"},{"url":"https://www.tp-link.com/en/support/download/archer-c7/v5/#Firmware"},{"url":"https://www.tp-link.com/us/support/download/archer-c7/v5/#Firmware"},{"url":"https://www.tp-link.com/us/support/faq/5362/"}],"tags":["nvd","cve.org"],"epss":0.00258,"epssPercentile":0.17427,"ingestedAt":"2026-09-08T20:10:03.161Z","vendor":"TP-Link Systems Inc.","product":"RE305 v3","affected":["re305_v3 < 1.1.8 Build 20260921 Rel. 42853","archer_c7_v5 < 1.3.1 Build 20260821 Rel. 41256"],"cvss":6.1,"cvssVector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-04T17:39:51.418332Z"},"cvssSource":"cna","slug":"CVE-2026-18330","body":"## Overview\n\nA hard-coded\ncryptographic key vulnerability exists in the web module of TP-Link Archer\nAX55 v4. A LAN attacker who captures an HTTP login session may use the known\nshared RSA private key to decrypt the administrator password; the\nweakened AES session key further reduces the effort required to\ncompromise session confidentiality.\n\n\n\n\n\nSuccessful\nexploitation may disclose the administrator password captured from an HTTP\nlogin session and compromise session confidentiality.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":229977,"id":"CVE-2026-18330","ts":1793123707848,"field":"cvss","old":null,"new":"6.1"},{"seq":229976,"id":"CVE-2026-18330","ts":1793123707848,"field":"severity","old":"none","new":"medium"}]}