CVE-2026-18330: CWE-321 Use of hard-coded cryptographic key in TP-Link Systems Inc. Archer AX55 v4

This vulnerability (CVE-2026-18330) affects the TP-Link Archer AX55 v4 router's web module. It involves the use of a hard-coded cryptographic key (CWE-321), specifically a shared RSA private key that an attacker can use to decrypt captured HTTP login sessions. The AES session key used is also weakened, which lowers the difficulty of compromising session confidentiality. Successful exploitation allows an attacker on the LAN to obtain the administrator password and breach session confidentiality.

An attacker with access to the local network who can capture HTTP login sessions may decrypt the administrator password using the hard-coded RSA private key. This leads to disclosure of sensitive credentials and compromises the confidentiality of the session. The weakened AES session key further facilitates this attack, increasing the risk of unauthorized access to the device's administrative interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Network administrators should monitor for vendor updates and consider restricting LAN access to trusted users until a fix is available.