Medium severity · published Jul 27, 2026
CVE-2026-12001
Hardcoded Credential Vulnerability in Multiple TP-Link Router Models
5.2
CVSS
0.3%
EPSS
No
On KEV
Description
A hardcoded credential
vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is
embedded within a password file in the firmware image and may be recovered
through firmware analysis.
Successful
exploitation could result in unauthorized access to privileged functions on
affected devices.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Archer C20 v6 · TP-Link Systems Inc.
before Archer C20(US)_V6_250630 · source: vendor
AM
Archer MR200 v5 · TP-Link Systems Inc.
before EU_V5.20_1.3.0 Build 260319 · source: vendor
TV
TL-WR845N v4 · TP Link Systems Inc.
before TL-WR845N(UN)_V4_250401 · source: vendor
TV
TL-WR850N v3 · TP-Link Systems Inc.
before TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048 · source: vendor
TV
TL-WR902AC v4 · TP Link Systems Inc.
before US_V4_0.9.1 Build 260810; before EU_V4_0.9.3 Build 260728 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12001
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12001
www.tp-link.com
https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware
www.tp-link.com
https://www.tp-link.com/en/support/download/archer-mr200/v5/#Firmware
www.tp-link.com
https://www.tp-link.com/en/support/download/tl-wr845n/#Firmware
www.tp-link.com
https://www.tp-link.com/en/support/download/tl-wr902ac/v4/#Firmware
www.tp-link.com
https://www.tp-link.com/in/support/download/archer-c20/v6/#Firmware
www.tp-link.com
https://www.tp-link.com/in/support/download/archer-mr200/v5/#Firmware