Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-18330— Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4

Quick assessment

Affected
TP-Link Systems Inc. Archer AX55 v4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

TP-Link Archer AX55 v4是中国TP-Link公司的一款网络设备产品。 TP-Link Archer AX55 v4 1.2.1 Build 20260527之前版本存在加密问题漏洞，该漏洞源于web模块存在硬编码加密密钥，可能允许局域网攻击者利用已知共享RSA私钥解密管理员密码，弱化的AES会话密钥进一步降低破坏会话机密性的难度，成功利用可泄露HTTP登录会话中捕获的管理员密码并破坏会话机密性。

CVSS 6.1 · Medium EPSS 0.26% · P17

Possible ATT&CK Techniques 1 AI

T1567 · Exfiltration Over Web Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
TP-Link Systems Inc. Archer AX55 v4 < 1.2.1 Build 20260527 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18330

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4
Source: CVE Program / CVE List V5
Vulnerability Description
A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to compromise session confidentiality. Successful exploitation may disclose the administrator password captured from an HTTP login session and compromise session confidentiality.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的密码学密钥
Source: CVE Program / CVE List V5
Vulnerability Title
TP-Link Archer AX55 v4 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TP-Link Archer AX55 v4是中国TP-Link公司的一款网络设备产品。 TP-Link Archer AX55 v4 1.2.1 Build 20260527之前版本存在加密问题漏洞，该漏洞源于web模块存在硬编码加密密钥，可能允许局域网攻击者利用已知共享RSA私钥解密管理员密码，弱化的AES会话密钥进一步降低破坏会话机密性的难度，成功利用可泄露HTTP登录会话中捕获的管理员密码并破坏会话机密性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
TP-Link Systems Inc. Archer AX55 v4 0 ~ 1.2.1 Build 20260527 -

II. Public POCs for CVE-2026-18330

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-18330

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-18330 (1)

Vendor Pages for CVE-2026-18330 (1)

IV. Related Vulnerabilities

Same product: Archer AX55 v4
Same vendor: TP-Link Systems Inc.
Same weakness: CWE-321