# CVE-2026-5363: TP-Link Archer C7 inadequate encryption in uhttpd modules

Source: https://junglewise.ai/threats/cve-2026-5363-tp-link-archer-c7-inadequate-encryption-in-uhttpd-modules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-16. Updated: 2026-05-22  
License: CC BY 4.0 with a link back

CVE-2026-5363 · Severity: high · CVSS 8.8 · Published 2026-04-16

TP-Link Archer C7 routers use weak encryption when transmitting administrator passwords during the login process. An attacker on the same local network could intercept this traffic and crack the password, gaining full control over the router's settings and security. This could lead to unauthorized access to the network or disruption of internet services.

Technologies: [TP-Link Archer C7](https://junglewise.ai/threats/technologies/archer-c7). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-5363 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5363 being exploited in the wild.

**How severe is CVE-2026-5363?** High severity, with a CVSS score of 8.8, published 16 April 2026.

**Which products and versions are affected?** TP-Link Archer C7 v5 and v5.8 through Build 20220715.

**Is there a fix for CVE-2026-5363?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5363 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-5363?** Check whether you run TP-Link Archer C7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The TP-Link Archer C7 (v5 and v5.8) web interface utilizes the uhttpd module to perform client-side encryption of administrator passwords using RSA-1024. Due to the relatively weak bit-length of the RSA key, an attacker positioned on the adjacent network (e.g., local Wi-Fi or LAN) can intercept the login traffic and perform a brute-force or factorization attack to recover the plaintext password. This vulnerability (CWE-326) allows for full device compromise. The issue affects firmware builds through 20220715. While the vendor has listed the product as End-of-Life (EOL), users are advised to check for firmware updates or replace the hardware.

## Affected products

- TP-Link Archer C7 v5 and v5.8 through Build 20220715

## Timeline

- 2026-04-15: disclosed: CVE received from TP-Link
- 2026-04-16: advisory: NVD publication date

## References

- [https://www.tp-link.com/us/support/faq/3562/](https://www.tp-link.com/us/support/faq/3562/)

## Related threats

- [TP-Link RE305 V3 and Archer C7 V5 hardcoded cryptographic key](https://junglewise.ai/threats/cve-2026-102812-a-hard-coded-cryptographic-key-vulnerability-exists-in-the-user)
- [TP-Link Archer C7 and TL-WR841N OS command injection in Parental Control](https://junglewise.ai/threats/cve-2025-9377-tp-link-archer-c7-and-tl-wr841n-os-command-injection-in-parental)