Statement on Hardcoded DES Decryption Keys in TP-Link Archer C50 V3/V4/V5 (CVE-2025-6982)

Important Information:

This device has reached end-of-life (EOL); therefore, please review the ‘Recommendation(s)’ section carefully.

Vulnerability Description:

Use of Hard-coded Credentials in TP-Link Archer C50 V3( <= 180703)/V4( <= 250117 )/V5( <= 200407 ), allows attackers to decrypt the config.xml file.

Impact:

This Hardcoded DES Decryption Keys may be used to decrypt the user config file.

CVSS v4.0 Score: 6.9 / Medium

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendation(s):

We strongly recommended that users with the affected device(s) take the following action(s):

1. Upgrade the device to one of our supported models to be able to receive automatic updates for ongoing protection.

Disclaimer:

If you do not take the recommended action(s) stated above, this vulnerability concern will remain. TP-Link cannot bear any responsibility for the consequences that could have been avoided by following the recommended action(s) in this statement.