CVE-2026-89052 Details
Description
A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials. Successful exploitation may allow unauthorized disclosure of sensitive information, including administrative credentials.
A vulnerability exists in the TP-Link Archer C6 V2 router due to a hardcoded universal cryptographic key used for AES encryption, shared across all devices. This vulnerability allows an attacker to decrypt configuration files or other encrypted credential data, potentially leading to the unauthorized disclosure of sensitive information such as administrative credentials.
Users are advised to update their Archer C6 V2 routers to the latest firmware version 1.2.1 Build 260902, available on the TP-Link official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.tp-link.com/us/support/download/archer-c6/v2/#Firmware | TPLink | ProductVendor |
| https://www.tp-link.com/us/support/faq/5356/ | TPLink | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | TPLink |
Affected Products
| Product | Versions |
|---|---|
| TP-Link Archer C6 | V2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | TPLink |