CVE-2026-8697 Improper Authentication Rate Limiting on TP-Link's Archer C64
Attackers can brute-force SSH credentials due to missing rate limiting, gaining full administrative access to the router.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8697?
CVE-2026-8697 is a high-severity authentication bypass vulnerability in TP-Link Systems Inc. Archer C64 v1.0, published on 28 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same credentials as the web interface. This enables an attacker to brute-force valid credentials via SSH.
Successful exploitation could allow an attacker with adjacent network access to obtain administrative credentials through unrestricted authentication attempts and subsequently gain full administrative access to the device, impacting system confidentiality, integrity, and availability.
Which versions are affected by CVE-2026-8697?
It affects 1 product.
Products include Tp-Link Archer C64 Firmware.
How do I fix CVE-2026-8697?
No fix has been published for CVE-2026-8697 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-8697 being exploited?
There is no known exploitation of CVE-2026-8697 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-f294-r353-6vv8.