CVE-2026-12001: Hardcoded Credential Vulnerability in Multiple TP-Link Router Models
A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis.
Successful exploitation could result in unauthorized access to privileged functions on affected devices.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12001?
CVE-2026-12001 has a medium severity rating with a CVSS score of 5.2.
How do I fix CVE-2026-12001?
To address CVE-2026-12001, users should update the firmware of their affected TP-Link routers to the latest version available.
Which TP-Link router models are affected by CVE-2026-12001?
CVE-2026-12001 affects the TP-Link TL-WR845N v4, TL-WR850N v3, Archer C20 v6, and Archer MR200 v5.
What type of vulnerability is CVE-2026-12001?
CVE-2026-12001 is a hardcoded credential vulnerability that allows recovery of embedded credentials from the firmware.
What are the risks associated with CVE-2026-12001?
The risks associated with CVE-2026-12001 include unauthorized access to network devices due to exposed hardcoded credentials.