CVE-2026-8697
Improper Authentication Rate Limiting on TP-Link's Archer C64
Description
Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same credentials as the web interface. This enables an attacker to brute-force valid credentials via SSH. Successful exploitation could allow an attacker with adjacent network access to obtain administrative credentials through unrestricted authentication attempts and subsequently gain full administrative access to the device, impacting system confidentiality, integrity, and availability.
CVSS Vector Breakdown
AV:AAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Attack Graph
Click technique nodes to view MITRE ATT&CK details. Scroll to zoom, drag to pan.
Exploitability
MITRE ATT&CK
2 techniquesReferences
Timeline
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-8697 and every CVE in our database. Create a free account — no credit card required.
Create Free Account