CVE-2026-4346

Received Received - Intake

Cleartext Credential Storage in TL-WR850N v3 Enables Full Admin Access

Publication date: 2026-03-26

Last updated on: 2026-03-31

Assigner: TPLink

Description

The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of the device’s flash memory while the serial interface remains enabled and protected by weak authentication. An attacker with physical access and the ability to connect to the serial port can recover sensitive information, including the router’s management password and wireless network key. Successful exploitation can lead to full administrative control of the device and unauthorized access to the associated wireless network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-26

Last Modified

2026-03-31

Generated

2026-07-06

AI Q&A

2026-03-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-4346

EUVD

EUVD-2026-16452

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	tl-wr850n_firmware	to 0.9.1_Build251205 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability affects the TL-WR850N v3 router and involves the storage of administrative and Wi-Fi credentials in cleartext within the device's flash memory.

Because the serial interface remains enabled and is protected only by weak authentication, an attacker with physical access to the device and the ability to connect to the serial port can retrieve sensitive information such as the router's management password and wireless network key.

Impact Analysis

Exploitation of this vulnerability can lead to an attacker gaining full administrative control over the affected device.

Additionally, the attacker can gain unauthorized access to the associated wireless network, potentially compromising network security and any data transmitted over it.

Hi! I’m here to help you understand CVE-2026-4346. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70