The vulnerability arises from improper enforcement of authentication rate-limiting on a debug SSH service in the TP-Link Archer C64 v1.0 router. The SSH service uses the same credentials as the web interface and does not limit authentication attempts, enabling brute-force attacks. An attacker with adjacent network access can exploit this to obtain administrative credentials and gain full control over the device. The CVSS 4.0 base score is 8.7, reflecting high severity with low attack complexity and no required privileges or user interaction.

An attacker who can access the adjacent network can brute-force the SSH service without restriction, potentially obtaining administrative credentials. This leads to full administrative access to the device, impacting system confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the debug SSH service to trusted hosts only, if possible, and monitor for unauthorized access attempts. Avoid exposing the device to untrusted networks.