TP-Link Archer C7 Inadequate Encryption Strength Vulnerability Allowing Password Recovery

A vulnerability exists in the TP-Link Archer C7 models v5 and v5.8, specifically within the uhttpd modules, due to inadequate encryption strength. The web interface encrypts the admin password using RSA-1024 before transmission to the router. An adjacent attacker capable of intercepting network traffic could exploit this weakness by performing a brute-force or factorization attack on the 1024-bit RSA key to recover the plaintext password. This would lead to unauthorized access and compromise of the device's configuration. The vulnerability affects Archer C7 models through Build 20220715.

Impact

Exploitation of this vulnerability could result in unauthorized access to the router's admin interface, allowing an attacker to change settings, potentially compromise the network, or misuse the device in other harmful ways.