CVE-2026-12001

Received Received - Intake

Hard-Coded Credentials in TP-Link Router Firmware

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: TPLink

Description

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-27

Generated

2026-07-28

AI Q&A

2026-07-28

EPSS Evaluated

N/A

NVD

CVE-2026-12001

EUVD

EUVD-2026-49587

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	tl-wr845n	4
tp-link	tl-wr850n	3
tp-link	archer_c20	6
tp-link	archer_mr200	5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves hardcoded credentials in the firmware of several TP-Link routers. The authentication-related credentials are embedded in a password file within the firmware image, which can be extracted through firmware analysis.

Detection Guidance

Detection requires firmware analysis since credentials are hardcoded. Use tools like binwalk to extract firmware images and search for embedded password files. Example command: binwalk -e firmware.bin to extract files for inspection.

Impact Analysis

Exploitation could allow unauthorized access to privileged functions on affected devices, potentially leading to device compromise or network breaches.

Mitigation Strategies

Immediately update router firmware to the latest version from TP-Link. If no update is available, isolate affected devices from the network and disable remote administration. Monitor for unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-12001. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70