A hard-coded
cryptographic key vulnerability exists in the user-configuration backup
mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and
initialization vector are embedded in the firmware configuration-management
component. An attacker who obtains an affected configuration backup file may
extract the cryptographic material from the firmware and use it to decrypt the
backup.
Successful exploitation may disclose sensitive configuration information contained in a backup file, including administrator passwords and Wi-Fi credentials.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
tp-link systems inc.:archer c7 v5
tp-link systems inc.:re305 v3
References 5
https://www.tp-link.com/en/support/download/archer-c7/v5/#Firmware
f23511db-6c3e-4e32-a477-6aa17d310630
https://www.tp-link.com/en/support/download/re305/v3/#Firmware
f23511db-6c3e-4e32-a477-6aa17d310630
https://www.tp-link.com/us/support/download/archer-c7/v5/#Firmware
f23511db-6c3e-4e32-a477-6aa17d310630
https://www.tp-link.com/us/support/download/re305/v3/#Firmware
f23511db-6c3e-4e32-a477-6aa17d310630
https://www.tp-link.com/us/support/faq/5362/
f23511db-6c3e-4e32-a477-6aa17d310630