CVE-2026-18330

A hard-coded

cryptographic key vulnerability exists in the web module of TP-Link Archer

AX55 v4. A LAN attacker who captures an HTTP login session may use the known

shared RSA private key to decrypt the administrator password; the

weakened AES session key further reduces the effort required to

compromise session confidentiality.

Successful

exploitation may disclose the administrator password captured from an HTTP

login session and compromise session confidentiality.