TI-2026-03782 Aliases CVE-2026-4346 GHSA-j2f5-7fm8-m5q7

Cleartext Storage of Administrative and Wi-Fi Credentials via Accessible Serial Interface in TP Link's TL-WR850N

LOW 22CWE-312Published 2026-03-26 · Updated 2026-03-27

Key facts

Attack vector: Physical
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312.

Summary

The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of the device’s flash memory while the serial interface remains enabled and protected by weak authentication. An attacker with physical access and the ability to connect to the serial port can recover sensitive information, including the router’s management password and wireless network key. Successful exploitation can lead to full administrative control of the device and unauthorized access to the associated wireless network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00129 2nd percentileScored 2026-11-07

Fix Fixed TL-WR850N v3 (TP-Link Systems Inc.): V3_0.9.1 Build251205

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TP-Link	TL-WR850N v3	before V3_0.9.1 Build251205	V3_0.9.1 Build251205	Patch available	CNA

TL-WR850N v3 VendorTP-Link Affected before V3_0.9.1 Build251205 Fixed in V3_0.9.1 Build251205 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:tp-link:tl-wr850n_firmware::::::::	before 0.9.1_Build251205	Vulnerable	TP-Link
cpe:2.3:h:tp-link:tl-wr850n:3:::::::*	3	Running on	TP-Link

cpe:2.3:o:tp-link:tl-wr850n_firmware:*:*:*:*:*:*:*:* Versions before 0.9.1_Build251205 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:tl-wr850n:3:*:*:*:*:*:*:* Versions 3 Running on ·TP-Link

Remediation

Fix · CNA TL-WR850N v3 (TP-Link Systems Inc.) Fixed in V3_0.9.1 Build251205

Timeline

2026-10-02 Threatist record created from CVE-2026-4346
2026-10-03 Alias added: GHSA-j2f5-7fm8-m5q7

References

Patch 1

https://www.tp-link.com/in/support/download/tl-wr850n/#Firmware

Advisory 1

https://www.tp-link.com/us/support/faq/5034/

TI-2025-14190 LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences