Skip to content
CVE PROGRAM SOURCE RECORD5.2 Medium

CVE-2026-12001

Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TPLink

Description

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5).  Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TP-Link Systems Inc. TL-WR850N v3

Default version status: unaffected

  • 0 to < TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048affected

TP-Link Systems Inc. Archer C20 v6

Default version status: unaffected

  • 0 to < Archer C20(US)_V6_250630affected

TP Link Systems Inc. TL-WR845N v4

Default version status: unaffected

  • 0 to < TL-WR845N(UN)_V4_250401affected

TP-Link Systems Inc. Archer MR200 v5

Default version status: unaffected

  • 0 to < EU_V5.20_1.3.0 Build 260319affected

TP Link Systems Inc. TL-WR902AC v4

Default version status: unaffected

  • 0 to < US_V4_0.9.1 Build 260810affected
  • 0 to < EU_V4_0.9.3 Build 260728affected

References