CVE-2026-8697: Improper Authentication Rate Limiting on TP-Link's Archer C64

Synopsis

Improper authentication rate-limiting in the debug SSH service of the TP-Link Archer C64 v1 router allows an attacker on the same network segment to brute-force administrative credentials without restriction. The SSH service exposes no lockout or throttling mechanism and shares credentials with the web management interface, so exhausting the credential space is purely a matter of time and compute. Successful exploitation gives an attacker full administrative control over the device, affecting confidentiality, integrity, and availability. A patched-image rebuild at version 1.15.0 Build 250729 Rel.63489n(4555) is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network such as the same LAN, Wi-Fi segment, or VPN; the device is not directly reachable from the open internet.

• AuthenticationNot required

  No credentials are needed to begin brute-forcing; the SSH service accepts unlimited unauthenticated login attempts with no lockout.

• Victim interactionNot required

  The attack is carried out entirely by the attacker against the SSH service; no user action or social engineering is involved.

• Attack complexityDetail

  The exploit is straightforward and condition-free: there are no race conditions, memory-layout dependencies, or environmental prerequisites beyond network adjacency.

Blast Radius

• Attacker recovers plaintext or crackable administrative credentials shared across SSH and the web management interface.
• Attacker gains full administrative access to the router, reading all device configuration including stored Wi-Fi passphrases, VPN keys, and connected-client data.
• Attacker modifies routing rules, DNS settings, firewall policies, or firmware to redirect or intercept traffic for all devices on the network.
• Attacker crashes or reboots the device at will, disrupting network connectivity for every client depending on the router.