CVE-2026-12001: Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

Severity: medium (CVSS 5.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-27 · updated 2026-08-11
Weakness: CWE-798

Description

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.

Affected products

TP-Link Systems Inc. Archer C20 v6: before Archer C20(US)_V6_250630 — fixed in Archer C20(US)_V6_250630
TP-Link Systems Inc. Archer MR200 v5: before EU_V5.20_1.3.0 Build 260319 — fixed in EU_V5.20_1.3.0 Build 260319
TP-Link Systems Inc. TL-WR850N v3: before TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048 — fixed in TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048
TP Link Systems Inc. TL-WR845N v4: before TL-WR845N(UN)_V4_250401 — fixed in TL-WR845N(UN)_V4_250401
TP Link Systems Inc. TL-WR902AC v4: before US_V4_0.9.1 Build 260810; before EU_V4_0.9.3 Build 260728 — fixed in EU_V4_0.9.3 Build 260728, US_V4_0.9.1 Build 260810

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. Archer C20 v6 Archer C20(US)_V6_250630; TP-Link Systems Inc. Archer MR200 v5 EU_V5.20_1.3.0 Build 260319; TP-Link Systems Inc. TL-WR850N v3 TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048; TP Link Systems Inc. TL-WR845N v4 TL-WR845N(UN)_V4_250401; TP Link Systems Inc. TL-WR902AC v4 EU_V4_0.9.3 Build 260728, US_V4_0.9.1 Build 260810. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-12001 or the next vulnerability affects your stack