This vulnerability involves the use of RSA-1024 encryption in the uhttpd modules of TP-Link Archer C7 v5 and v5.8 routers to protect the admin password during login. RSA-1024 is considered weak by modern cryptographic standards and susceptible to factorization attacks. An attacker with network adjacency and interception capability could exploit this weakness to recover the administrator password by breaking the RSA encryption. The affected versions include builds through 20220715. The CVSS 4.0 score is 5.4 (medium severity), reflecting the attack vector as adjacent network with high attack complexity and partial impact on confidentiality. No vendor advisory or patch information is currently provided, and no known exploits have been observed.

Successful exploitation could allow an adjacent attacker to recover the plaintext administrator password by breaking the RSA-1024 encryption protecting the password during login. This would enable unauthorized access to the router's administrative interface and potentially full compromise of device configuration. The impact is limited to devices running affected firmware versions and requires network adjacency and interception capability. There is no indication of impact on availability or integrity beyond administrative access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit network adjacency exposure by restricting access to the router's management interface and avoid using vulnerable firmware versions. Monitoring for vendor updates is recommended.