2 lines
4.9 KiB
JSON
2 lines
4.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["uhttpd"],"product":"Archer C7 v5 and v5.8","vendor":"TP-Link Systems Inc.","versions":[{"lessThanOrEqual":"Build 20220715","status":"affected","version":"0","versionType":"custom"}]}],"source":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:tp-link:archer_c7_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"EEC8A9A3-E042-4152-9AED-DCF418B94FC2","versionEndExcluding":"1.2.1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:tp-link:archer_c7:5.0:*:*:*:*:*:*:*","matchCriteriaId":"33EEE609-7209-4402-995B-A09BCA84C9A6","vulnerable":false},{"criteria":"cpe:2.3:h:tp-link:archer_c7:5.80:*:*:*:*:*:*:*","matchCriteriaId":"351D38AB-71BD-4D45-8F15-BC31E284DCE7","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[{"sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login. \nAn adjacent attacker with the ability to intercept network traffic could potentially perform a brute-force or factorization attack against the 1024-bit RSA key to recover the plaintext administrator password, leading to unauthorized access and compromise of the device configuration. This issue affects Archer C7: through Build 20220715."},{"lang":"es","value":"Vulnerabilidad de fuerza de cifrado inadecuada en TP-Link Archer C7 v5 y v5.8 (módulos uhttpd) permite la explotación para la recuperación de contraseñas. La interfaz web cifra la contraseña de administrador del lado del cliente usando RSA-1024 antes de enviarla al router durante el inicio de sesión. Un atacante adyacente con la capacidad de interceptar el tráfico de red podría potencialmente realizar un ataque de fuerza bruta o de factorización contra la clave RSA de 1024 bits para recuperar la contraseña de administrador en texto plano, lo que lleva a un acceso no autorizado y al compromiso de la configuración del dispositivo. Este problema afecta a Archer C7: hasta la compilación 20220715."}],"id":"CVE-2026-5363","lastModified":"2026-10-26T21:10:00.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5363","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-16T13:17:25.657073Z","version":"2.0.3"}}]},"published":"2026-04-16T00:16:29.547","references":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Not Applicable"],"url":"https://www.tp-link.com/us/support/faq/3562/"}],"sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-326"}],"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary"}]}
|