GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for Archer AX55 v4 by TP-Link Systems Inc.

    CVE-2026-18330 (GCVE-0-2026-18330)

    Vulnerability from nvd – Published: 2026-09-03 22:24 – Updated: 2026-09-04 18:25
    VLAI
    Title
    Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4
    Summary
    A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to compromise session confidentiality. Successful exploitation may disclose the administrator password captured from an HTTP login session and compromise session confidentiality.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:39 UTC
    CWE
    • CWE-321 - Use of hard-coded cryptographic key
    Impacted products
    Vendor Product Version
    TP-Link Systems Inc. Archer AX55 v4 Affected: 0 , < 1.2.1 Build 20260527 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18330",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T17:39:51.418332Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:25:58.339Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "modules": [
                "web"
              ],
              "product": "Archer AX55 v4",
              "vendor": "TP-Link Systems Inc.",
              "versions": [
                {
                  "lessThan": "1.2.1 Build 20260527",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Tianchang Yang and Syed Rafiul Hussain (SyNSec Lab, Penn State University)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA hard-coded\ncryptographic key vulnerability exists in the\u0026nbsp;web module of TP-Link Archer\nAX55 v4. A LAN attacker who captures an HTTP login session may use the known\nshared RSA private key to decrypt the\u0026nbsp;administrator\u0026nbsp;password; the\nweakened AES session key further reduces the effort\u0026nbsp;required\u0026nbsp;to\ncompromise session confidentiality.\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may disclose the administrator password captured from an HTTP\nlogin session and compromise session confidentiality.\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
                }
              ],
              "value": "A hard-coded\ncryptographic key vulnerability exists in the\u00a0web module of TP-Link Archer\nAX55 v4. A LAN attacker who captures an HTTP login session may use the known\nshared RSA private key to decrypt the\u00a0administrator\u00a0password; the\nweakened AES session key further reduces the effort\u00a0required\u00a0to\ncompromise session confidentiality.\n\n\n\n\n\nSuccessful\nexploitation may disclose the administrator password captured from an HTTP\nlogin session and compromise session confidentiality."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-117",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-117 Interception"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "ADJACENT",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-321",
                  "description": "CWE-321 Use of hard-coded cryptographic key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T22:24:45.430Z",
            "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
            "shortName": "TPLink"
          },
          "references": [
            {
              "tags": [
                "patch"
              ],
              "url": "https://www.tp-link.com/us/support/download/archer-ax55/v4/#Firmware"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.tp-link.com/us/support/faq/5279/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "assignerShortName": "TPLink",
        "cveId": "CVE-2026-18330",
        "datePublished": "2026-09-03T22:24:45.430Z",
        "dateReserved": "2026-07-29T20:03:53.524Z",
        "dateUpdated": "2026-09-04T18:25:58.339Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18167 (GCVE-0-2026-18167)

    Vulnerability from nvd – Published: 2026-09-03 22:24 – Updated: 2026-09-04 18:25
    VLAI
    Title
    Stack-based buffer overflow in TP-Link Archer AX55 v4
    Summary
    A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation may cause the EasyMesh daemon to crash and may potentially allow remote code execution when Mesh mode is enabled. This may result in high impact to the confidentiality, integrity, and availability of the affected device.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:09 UTC
    CWE
    • CWE-121 - Stack-based buffer overflow
    Impacted products
    Vendor Product Version
    TP-Link Systems Inc. Archer AX55 v4 Affected: 0 , < 1.2.1 Build 20260527 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18167",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T17:09:09.470755Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:25:53.240Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "modules": [
                "easymesh"
              ],
              "product": "Archer AX55 v4",
              "vendor": "TP-Link Systems Inc.",
              "versions": [
                {
                  "lessThan": "1.2.1 Build 20260527",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Tianchang Yang and Syed Rafiul Hussain (SyNSec Lab, Penn State University)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA\nstack-based buffer overflow vulnerability exists in the EasyMesh module of\nTP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit\ncrafted input that causes the easymesh daemon to crash and may potentially\nachieve remote code execution on the device.\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may cause the EasyMesh daemon to crash and may potentially allow\nremote code execution when Mesh mode is enabled. This\nmay result in high impact to the confidentiality, integrity, and availability\nof the affected device.\u003c/p\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
                }
              ],
              "value": "A\nstack-based buffer overflow vulnerability exists in the EasyMesh module of\nTP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit\ncrafted input that causes the easymesh daemon to crash and may potentially\nachieve remote code execution on the device.\n\n\n\n\n\nSuccessful\nexploitation may cause the EasyMesh daemon to crash and may potentially allow\nremote code execution when Mesh mode is enabled. This\nmay result in high impact to the confidentiality, integrity, and availability\nof the affected device."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-47",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-47 Buffer Overflow via Parameter Expansion"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "PRESENT",
                "attackVector": "ADJACENT",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-121",
                  "description": "CWE-121 Stack-based buffer overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T22:24:57.369Z",
            "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
            "shortName": "TPLink"
          },
          "references": [
            {
              "tags": [
                "patch"
              ],
              "url": "https://www.tp-link.com/us/support/download/archer-ax55/v4/#Firmware"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.tp-link.com/us/support/faq/5279/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Stack-based buffer overflow in TP-Link Archer AX55 v4",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "assignerShortName": "TPLink",
        "cveId": "CVE-2026-18167",
        "datePublished": "2026-09-03T22:24:57.369Z",
        "dateReserved": "2026-07-28T20:48:04.039Z",
        "dateUpdated": "2026-09-04T18:25:53.240Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18167 (GCVE-0-2026-18167)

    Vulnerability from cvelistv5 – Published: 2026-09-03 22:24 – Updated: 2026-09-04 18:25
    VLAI
    Title
    Stack-based buffer overflow in TP-Link Archer AX55 v4
    Summary
    A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation may cause the EasyMesh daemon to crash and may potentially allow remote code execution when Mesh mode is enabled. This may result in high impact to the confidentiality, integrity, and availability of the affected device.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:09 UTC
    CWE
    • CWE-121 - Stack-based buffer overflow
    Impacted products
    Vendor Product Version
    TP-Link Systems Inc. Archer AX55 v4 Affected: 0 , < 1.2.1 Build 20260527 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18167",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T17:09:09.470755Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:25:53.240Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "modules": [
                "easymesh"
              ],
              "product": "Archer AX55 v4",
              "vendor": "TP-Link Systems Inc.",
              "versions": [
                {
                  "lessThan": "1.2.1 Build 20260527",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Tianchang Yang and Syed Rafiul Hussain (SyNSec Lab, Penn State University)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA\nstack-based buffer overflow vulnerability exists in the EasyMesh module of\nTP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit\ncrafted input that causes the easymesh daemon to crash and may potentially\nachieve remote code execution on the device.\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may cause the EasyMesh daemon to crash and may potentially allow\nremote code execution when Mesh mode is enabled. This\nmay result in high impact to the confidentiality, integrity, and availability\nof the affected device.\u003c/p\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
                }
              ],
              "value": "A\nstack-based buffer overflow vulnerability exists in the EasyMesh module of\nTP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit\ncrafted input that causes the easymesh daemon to crash and may potentially\nachieve remote code execution on the device.\n\n\n\n\n\nSuccessful\nexploitation may cause the EasyMesh daemon to crash and may potentially allow\nremote code execution when Mesh mode is enabled. This\nmay result in high impact to the confidentiality, integrity, and availability\nof the affected device."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-47",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-47 Buffer Overflow via Parameter Expansion"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "PRESENT",
                "attackVector": "ADJACENT",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-121",
                  "description": "CWE-121 Stack-based buffer overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T22:24:57.369Z",
            "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
            "shortName": "TPLink"
          },
          "references": [
            {
              "tags": [
                "patch"
              ],
              "url": "https://www.tp-link.com/us/support/download/archer-ax55/v4/#Firmware"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.tp-link.com/us/support/faq/5279/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Stack-based buffer overflow in TP-Link Archer AX55 v4",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "assignerShortName": "TPLink",
        "cveId": "CVE-2026-18167",
        "datePublished": "2026-09-03T22:24:57.369Z",
        "dateReserved": "2026-07-28T20:48:04.039Z",
        "dateUpdated": "2026-09-04T18:25:53.240Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18330 (GCVE-0-2026-18330)

    Vulnerability from cvelistv5 – Published: 2026-09-03 22:24 – Updated: 2026-09-04 18:25
    VLAI
    Title
    Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4
    Summary
    A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to compromise session confidentiality. Successful exploitation may disclose the administrator password captured from an HTTP login session and compromise session confidentiality.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:39 UTC
    CWE
    • CWE-321 - Use of hard-coded cryptographic key
    Impacted products
    Vendor Product Version
    TP-Link Systems Inc. Archer AX55 v4 Affected: 0 , < 1.2.1 Build 20260527 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18330",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T17:39:51.418332Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:25:58.339Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "modules": [
                "web"
              ],
              "product": "Archer AX55 v4",
              "vendor": "TP-Link Systems Inc.",
              "versions": [
                {
                  "lessThan": "1.2.1 Build 20260527",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Tianchang Yang and Syed Rafiul Hussain (SyNSec Lab, Penn State University)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA hard-coded\ncryptographic key vulnerability exists in the\u0026nbsp;web module of TP-Link Archer\nAX55 v4. A LAN attacker who captures an HTTP login session may use the known\nshared RSA private key to decrypt the\u0026nbsp;administrator\u0026nbsp;password; the\nweakened AES session key further reduces the effort\u0026nbsp;required\u0026nbsp;to\ncompromise session confidentiality.\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may disclose the administrator password captured from an HTTP\nlogin session and compromise session confidentiality.\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
                }
              ],
              "value": "A hard-coded\ncryptographic key vulnerability exists in the\u00a0web module of TP-Link Archer\nAX55 v4. A LAN attacker who captures an HTTP login session may use the known\nshared RSA private key to decrypt the\u00a0administrator\u00a0password; the\nweakened AES session key further reduces the effort\u00a0required\u00a0to\ncompromise session confidentiality.\n\n\n\n\n\nSuccessful\nexploitation may disclose the administrator password captured from an HTTP\nlogin session and compromise session confidentiality."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-117",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-117 Interception"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "ADJACENT",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-321",
                  "description": "CWE-321 Use of hard-coded cryptographic key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T22:24:45.430Z",
            "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
            "shortName": "TPLink"
          },
          "references": [
            {
              "tags": [
                "patch"
              ],
              "url": "https://www.tp-link.com/us/support/download/archer-ax55/v4/#Firmware"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.tp-link.com/us/support/faq/5279/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "assignerShortName": "TPLink",
        "cveId": "CVE-2026-18330",
        "datePublished": "2026-09-03T22:24:45.430Z",
        "dateReserved": "2026-07-29T20:03:53.524Z",
        "dateUpdated": "2026-09-04T18:25:58.339Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }