Statement on Hardcoded DES Decryption Keys in TP-Link Archer C50 V3/V4/V5 and C20 V5 (CVE-2025-6982)

Important Information:

These devices have reached end-of-life (EOL); therefore, please review the ‘Recommendation(s)’ section carefully.

Vulnerability Description:

Use of Hard-coded Credentials in TP-Link Archer C20 V5 and C50 V3( <= 180703)/V4( <= 250117 )/V5( <= 200407 ), allows attackers to decrypt the config.xml file.

Impact:

This Hardcoded DES Decryption Keys may be used to decrypt the user config file.

CVSS v4.0 Score: 6.9 / Medium

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendation(s):

We strongly recommended that users with the affected device(s) take the following action(s):

1. Upgrade the device to one of our supported models to be able to receive automatic updates for ongoing protection.
2. For C20 V5, download and update to the latest firmware to fix the vulnerabilities.

EN: Download for Archer C20 | TP-Link

US: Download for Archer C20 | TP-Link

Disclaimer:

If you do not take the recommended action(s) stated above, this vulnerability concern will remain. TP-Link cannot bear any responsibility for the consequences that could have been avoided by following the recommended action(s) in this statement.