TP-Link Archer C50 router is vulnerable to configuration-file decryption

ronjor · Jul 30, 2025

Vulnerability Note VU#554637
Original Release Date: 2025-07-29 | Last Revised: 2025-07-29

Overview
The TP-Link Archer C50 router, which has reached End-of-Life (EOL), contains a hardcoded encryption key in its firmware, enabling decryption of sensitive configuration files. This vulnerability allows attackers to trivially access administrative credentials, Wi-Fi passwords, and other internal settings, after authentication to the device.
Click to expand...

Solution
The CERT/CC is currently unaware of a practical solution to this problem. Note: The TP-Link Archer C50 has reached End-of-Life (EOL) and no longer receives firmware updates or security support from the vendor.
Click to expand...

Users are strongly advised to:
Retire and replace the Archer C50 with a supported router model
Avoid using devices with known cryptographic flaws
Secure or delete any exported configuration files
Change passwords if configuration files were exposed or restored from backup
Click to expand...

Log in or Sign up

TP-Link Archer C50 router is vulnerable to configuration-file decryption

ronjor Global Moderator

Log in or Sign up

TP-Link Archer C50 router is vulnerable to configuration-file decryption

ronjor Global Moderator

Useful Searches