CVE-2026-12001
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Hardcoded Credential Vulnerability in Multiple TP-Link Router Models
A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
TL-WR850N v3
- Vendor
- TP-Link Systems Inc.
- Product
- TL-WR850N v3
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048 | Unavailable | None listed |
Archer C20 v6
- Vendor
- TP-Link Systems Inc.
- Product
- Archer C20 v6
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | Archer C20(US)_V6_250630 | Unavailable | None listed |
TL-WR845N v4
- Vendor
- TP Link Systems Inc.
- Product
- TL-WR845N v4
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | TL-WR845N(UN)_V4_250401 | Unavailable | None listed |
Archer MR200 v5
- Vendor
- TP-Link Systems Inc.
- Product
- Archer MR200 v5
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | EU_V5.20_1.3.0 Build 260319 | Unavailable | None listed |
TL-WR902AC v4
- Vendor
- TP Link Systems Inc.
- Product
- TL-WR902AC v4
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | US_V4_0.9.1 Build 260810 | Unavailable | None listed |
| 0 | affected | custom | EU_V4_0.9.3 Build 260728 | Unavailable | None listed |