Skip to content
OpenAdvisories
Medium · 5.9 Public exploit CVE-2026-89052 EUVD-2026-107666GHSA-9cmp-4hhr-2px3

Hardcoded AES encryption key in Archer C6

Published Oct 21, 2026 · Updated Oct 30, 2026 · Assigned by TPLink

Vendor: TP-Link Systems Product: Archer C6 V2 Category: Network devices

Description

A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials. 

Successful exploitation may allow unauthorized disclosure of sensitive information, including administrative credentials.

Affected products

VendorProductAffectedFixed
TP-Link Systems Archer C6 V2 < 1.2.1 Build 260902 1.2.1 Build 260902

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References