CVE-2026-12001CWE-798hardcoded-credentials

CVE-2026-12001

published July 28, 2026

CVSS
5.2
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

A hardcoded credential

vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5).  Authentication-related credential material is

embedded within a password file in the firmware image and may be recovered

through firmware analysis.

Successful

exploitation could result in unauthorized access to privileged functions on

affected devices.

The record
Technical detail
CVSS
5.2 · NONE
CVSS v4.0
Not supplied
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-07-28T01:16Z
References (11)
https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/archer-mr200/v5/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/tl-wr845n/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/tl-wr902ac/v4/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/in/support/download/archer-c20/v6/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/in/support/download/archer-mr200/v5/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/in/support/download/tl-wr845n/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/in/support/download/tl-wr850n/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/download/archer-c20/v6/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/download/tl-wr902ac/v4/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/faq/5210/ · f23511db-6c3e-4e32-a477-6aa17d310630
EPSS history
Timeline
  • 27 JUL 20:08Z
    Hardcoded Credential Vulnerability in Multiple TP-Link Router Models
    cvelistv5