CVE-2025-6982 describes a hard-coded credentials vulnerability in specific versions of TP-Link Archer C50 V3, V4, and V5 routers. This flaw allows an authenticated attacker on the local network to decrypt the router's configuration file (config.xml). Rated with a CVSS score of 6.9 (Medium), the vulnerability has a low attack complexity and requires local network access and authentication, but can lead to high confidentiality impact. Currently, there is no public exploit code available, no evidence of active exploitation, and minimal community discussion or media coverage, indicating a low immediate threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| TP-Link Systems Inc. | Archer C20 V5 | >= 0, < EU_V5_260317, >= 0, < US_V5_260419CNA affecteddefault unaffected | |
| TP-Link Systems Inc. | Archer C50 V3 | >= 0, <= 180703CNA affecteddefault unaffected | |
| TP-Link Systems Inc. | Archer C50 V4 | >= 0, <= 250117CNA affecteddefault unaffected | |
| TP-Link Systems Inc. | Archer C50 V5 | >= 0, <= 200407CNA affecteddefault unaffected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.0 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.