Hardcoded Credential Vulnerability in Multiple TP-Link Router Models
Priority LOW 24CWE-798Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00343 28th percentileScored 2026-11-07
Fix Fixed TL-WR850N v3 (TP-Link Systems Inc.): TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048Archer C20 v6 (TP-Link Systems Inc.): Archer C20(US)_V6_250630+3 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TP-Link | TL-WR850N v3 | before TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048 | TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048 | Patch available | CNA |
| TP-Link | Archer C20 v6 | before Archer C20(US)_V6_250630 | Archer C20(US)_V6_250630 | Patch available | CNA |
| TP-Link | TL-WR845N v4 | before TL-WR845N(UN)_V4_250401 | TL-WR845N(UN)_V4_250401 | Patch available | CNA |
| TP-Link | Archer MR200 v5 | before EU_V5.20_1.3.0 Build 260319 | EU_V5.20_1.3.0 Build 260319 | Patch available | CNA |
| TP-Link | TL-WR902AC v4 | before US_V4_0.9.1 Build 260810; before EU_V4_0.9.3 Build 260728 | US_V4_0.9.1 Build 260810, EU_V4_0.9.3 Build 260728 | Patch available | CNA |
- TL-WR850N v3 VendorTP-Link Affected before TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048 Fixed in TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048 Patch available CNA
- Archer C20 v6 VendorTP-Link Affected before Archer C20(US)_V6_250630 Fixed in Archer C20(US)_V6_250630 Patch available CNA
- TL-WR845N v4 VendorTP-Link Affected before TL-WR845N(UN)_V4_250401 Fixed in TL-WR845N(UN)_V4_250401 Patch available CNA
- Archer MR200 v5 VendorTP-Link Affected before EU_V5.20_1.3.0 Build 260319 Fixed in EU_V5.20_1.3.0 Build 260319 Patch available CNA
- TL-WR902AC v4 VendorTP-Link Affected before US_V4_0.9.1 Build 260810; before EU_V4_0.9.3 Build 260728 Fixed in US_V4_0.9.1 Build 260810, EU_V4_0.9.3 Build 260728 Patch available CNA
Remediation
- Fix · CNA TL-WR850N v3 (TP-Link Systems Inc.) Fixed in TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048
- Fix · CNA Archer C20 v6 (TP-Link Systems Inc.) Fixed in Archer C20(US)_V6_250630
- Fix · CNA TL-WR845N v4 (TP Link Systems Inc.) Fixed in TL-WR845N(UN)_V4_250401
- Fix · CNA Archer MR200 v5 (TP-Link Systems Inc.) Fixed in EU_V5.20_1.3.0 Build 260319
- Fix · CNA TL-WR902AC v4 (TP Link Systems Inc.) Fixed in US_V4_0.9.1 Build 260810, EU_V4_0.9.3 Build 260728
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12001
- 2026-10-03 Alias added: GHSA-884r-qm45-3j9g
References
Patch 10
- https://www.tp-link.com/en/support/download/archer-mr200/v5/#Firmware
- https://www.tp-link.com/in/support/download/archer-mr200/v5/#Firmware
- https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware
- https://www.tp-link.com/us/support/download/archer-c20/v6/#Firmware
- https://www.tp-link.com/in/support/download/archer-c20/v6/#Firmware
- https://www.tp-link.com/en/support/download/tl-wr845n/#Firmware
- https://www.tp-link.com/in/support/download/tl-wr845n/#Firmware
- https://www.tp-link.com/in/support/download/tl-wr850n/#Firmware
- https://www.tp-link.com/us/support/download/tl-wr902ac/v4/#Firmware
- https://www.tp-link.com/en/support/download/tl-wr902ac/v4/#Firmware
More TP-Link vulnerabilities
- TI-2023-16571 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain… KEVCVSS 3.1HIGH 8.8
- TI-2023-01313 Command injection in TP-Link Archer AX21 KEVCVSS 3.1HIGH 8.8
- TI-2020-14907 TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the… KEVCVSS 3.1HIGH 8.8
- TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
- TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
- TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-12001 · CVE Program
- CVE-2026-12001 · NVD
- FIRST EPSS
- GHSA-884r-qm45-3j9g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences