TP-Link Archer C7, Archer C6 and RE305 Firmware Update: Seven CVEs, the Fixed Builds, and How to Install Them

Last updated: November 2026

This guide is for owners of the TP-Link Archer C7, the Archer C6 and the RE305 WiFi extender, three of the most widely sold budget networking products of the last decade. TP-Link published fixed firmware for all three in late 2026 after seven security flaws were disclosed. This article lists the CVE numbers and severity scores, the exact firmware build that fixes each model, how to check your hardware version, and how to install the update. Details were checked on November 12, 2026 against TP-Link's two security advisories, its US download pages and the Hong Kong CERT bulletin that summarized the set.

Key Takeaways

• Seven CVEs cover the three products: six on the RE305 V3, two on the Archer C7 V5, and one, a hardcoded encryption key, on the Archer C6 V2. The highest score is 8.7 (High) for CVE-2026-102814 on the RE305. The rest are rated Medium.
• Fixed firmware: Archer C7 V5 at 1.3.1 Build 20260821, Archer C6 V2 at 1.2.1 Build 260902, and RE305 V3 at 1.1.8 Build 20260921. The US Archer C7 download was posted on November 3, 2026.
• Older hardware versions of these models are not named in the advisories. If your unit is an Archer C7 V1 through V4 or an RE305 V1 or V2, check the download page for your version and plan to replace the unit if no 2026 firmware is listed.

What did TP-Link disclose?

TP-Link published two advisories. The first, last updated October 21, 2026, covers a hardcoded AES encryption key in the Archer C6 V2 (CVE-2026-89052, CVSS 4.0 score 5.9, Medium). A hardcoded key is a secret that is identical on every unit sold, which means anyone who extracts it from one router has it for all of them.

The second, last updated October 27, 2026, covers six flaws in the RE305 V3 and Archer C7 V5: CVE-2026-18330 and CVE-2026-102812 through CVE-2026-102816. The Hong Kong Computer Emergency Response Team summarized the full set in a bulletin on November 5, 2026, describing the impact as elevation of privilege, remote code execution and information disclosure, with an overall rating of Medium risk.

A CVE is a public ID number for a specific security flaw. CVSS is the 0 to 10 scale used to score how severe a flaw is. TP-Link's scores are under CVSS version 4.0.

Which models and firmware versions are affected?

The individual scores TP-Link lists are 6.1 for CVE-2026-18330, 6.9 for CVE-2026-102812, 6.1 for CVE-2026-102813, 8.7 for CVE-2026-102814, 6.9 for CVE-2026-102815 and 5.3 for CVE-2026-102816. CVE-2026-102813 and CVE-2026-102814 apply to the RE305 only. TP-Link's advisory page repeats one heading with the wrong description, so the per-flaw details are less tidy than the firmware table; the firmware build numbers are the part to act on.

The advisories do not say whether any of the seven flaws has been used in attacks. None appears in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog as of November 12, 2026. CISA does list earlier TP-Link flaws in other models as exploited, which is reason enough to treat an Archer update as routine maintenance rather than optional.

How do I find my Archer C7 hardware version?

Turn the router over. The label lists the model and a version such as "V5.8" or "Ver: 2.0." The version decides which firmware file fits; a file for the wrong hardware version will be rejected by the router or, in rare cases, brick it. The version also appears in the router's web page under the firmware information.

On the RE305, the version is on the label on the back of the plug. On the Archer C6, it is on the bottom label.

How do I update Archer C7, Archer C6 and RE305 firmware?

TP-Link offers two routes for routers: the Tether app, which checks for updates automatically, and a manual upload in the web page. Extenders use the same web page method.

In the Tether app:

1. Connect your phone to the router's WiFi and open Tether.
2. Tap the router, then Tools, then System, then Firmware Update.
3. If an update is offered, tap Update and leave the router powered on until it restarts.

In a web browser, with a manual file:

1. Go to the TP-Link support download page for your model, select your hardware version, and download the newest firmware. For the US Archer C7 V5 that is the file labeled 1.3.1 Build 20260821. Unzip it; the file inside ends in .bin.
2. Connect a computer to the router with an Ethernet cable. A wired connection avoids the update failing partway through.
3. Open tplinkwifi.net (or tplinkrepeater.net for the RE305) and sign in.
4. Go to Advanced, then System Tools, then Firmware Upgrade. Older firmware shows System Tools, then Firmware Upgrade, with no Advanced tab.
5. Click Browse, choose the .bin file, and click Upgrade. Confirm.
6. Wait for the progress bar to finish and the router to reboot, usually two to three minutes. Do not unplug it.
7. Sign in again and confirm the firmware version shown matches the build you installed.

A normal update keeps your WiFi name, password and settings. If the router behaves oddly after the update, a factory reset and fresh setup clears it; our router reset guide covers the difference between a restart and a factory reset. If problems were there before the update, start with our Archer troubleshooting guide. For extender setup after an update, see how to set up a TP-Link WiFi extender.

What if my hardware version has no 2026 firmware?

TP-Link's US download page lists Archer C7 hardware versions from V1 through V5.8, and the Archer C6 and RE305 have each shipped in several hardware versions. The advisories name only the Archer C7 V5, the Archer C6 V2 and the RE305 V3. That leaves two possibilities for other versions: either they do not contain the flawed code, or they are past support and will not be fixed. TP-Link's advisories do not say which.

Check the download page for your version. If the newest firmware is dated 2022 or earlier, treat the unit as end of life. Until you replace it, change the admin password to one you use nowhere else, turn off remote management and WPS, and keep smart home devices on the guest network. Our guide to how long routers last covers when to retire one.

On replacement, one US-specific wrinkle: in March 2026 the FCC stopped authorizing new router models made outside the United States unless the maker holds a conditional approval. Models authorized before that date can still be sold and updated, and the FCC extended a waiver in May 2026 so they keep receiving firmware. Our FCC router ban guide lists the approved brands, and our best WiFi 7 routers guide covers current picks.

FAQ

Is the TP-Link Archer C7 still safe to use in 2026?

An Archer C7 V5 running firmware 1.3.1 Build 20260821 or later has the two disclosed flaws fixed. Older hardware versions are not named in TP-Link's advisory; check the download page for your version and replace the router if no 2026 firmware is offered.

What is the latest firmware for the Archer C7?

For the US Archer C7 V5 (V5.8 on the download page), 1.3.1 Build 20260821, posted November 3, 2026. The previous release was 1.2.1 Build 20220715 from November 2022.

Does the Archer C6 firmware fix a serious problem?

CVE-2026-89052 is rated 5.9, Medium. It is a hardcoded encryption key shared across devices, which weakens any protection that depends on the key being secret. The fix is in firmware 1.2.1 Build 260902 for the Archer C6 V2.

How do I update the RE305 extender?

Download the RE305 V3 firmware 1.1.8 Build 20260921 from TP-Link's support site, sign in at tplinkrepeater.net, go to System Tools, then Firmware Upgrade, choose the file and click Upgrade.

Can these TP-Link flaws be exploited from the internet?

The Hong Kong CERT bulletin says a remote attacker could exploit some of them. TP-Link's advisories do not state whether remote management must be enabled. Turning off remote management, which is off by default, removes the most direct path from the internet.

Will the firmware update erase my settings?

A normal update keeps your settings. If you upload a file for the wrong hardware version the router will usually reject it, so confirm the version on the label first.

Sources and how this article was reported

CVE numbers, scores and firmware builds come from TP-Link's two advisories and its US download page, read on November 12, 2026, with the Hong Kong CERT bulletin as a secondary summary. Update steps are from TP-Link's support documentation and may differ slightly by firmware version. We did not contact TP-Link for comment. ModemGuides sells refurbished routers and extenders, including TP-Link models.

• TP-Link Security Advisory: Multiple Vulnerabilities in TP-Link RE305 and Archer C7
• TP-Link Security Advisory: Hardcoded AES encryption key in Archer C6 (CVE-2026-89052)
• TP-Link Archer C7 download page (US)
• HKCERT, November 5, 2026: TP-Link Router Multiple Vulnerabilities
• CISA Known Exploited Vulnerabilities catalog