Quick answers
- Is CVE-2026-102812 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-102812 being exploited in the wild.
- How severe is CVE-2026-102812?
- Informational severity, published 27 October 2026.
- Which products and versions are affected?
- TP-Link Archer C7 V5; TP-Link RE305 V3.
- Is there a fix for CVE-2026-102812?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-102812 attacked?
- It is attacked with local access, in device firmware.
- Am I affected by CVE-2026-102812?
- Check whether you run TP-Link Archer C7 or TP-Link RE305 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component for backup encryption. An attacker with access to a configuration backup file can extract the cryptographic material and decrypt the backup without authentication. Disclosure of administrative passwords and network credentials enables unauthorized access to affected devices and networks.
Affected products
- TP-Link RE305 V3
- TP-Link Archer C7 V5
Timeline
- 2026-10-27: disclosed