CVE-2026-12001

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.

CVSS

No CVSS.

References

Link	Resource
https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware
https://www.tp-link.com/en/support/download/archer-mr200/v5/#Firmware
https://www.tp-link.com/en/support/download/tl-wr845n/#Firmware
https://www.tp-link.com/in/support/download/archer-c20/v6/#Firmware
https://www.tp-link.com/in/support/download/archer-mr200/v5/#Firmware
https://www.tp-link.com/in/support/download/tl-wr845n/#Firmware
https://www.tp-link.com/in/support/download/tl-wr850n/#Firmware
https://www.tp-link.com/us/support/download/archer-c20/v6/#Firmware
https://www.tp-link.com/us/support/faq/5210/

Configurations

No configuration.

History

27 Jul 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-27 21:16

Updated : 2026-07-28 16:20

NVD link : CVE-2026-12001

Mitre link : CVE-2026-12001

CVE.ORG link : CVE-2026-12001

JSON object : View

Products Affected

No product.

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2026-12001", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12001", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T15:09:04.473247Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.2, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "TL-WR850N v3", "versions": [{"status": "affected", "version": "0", "lessThan": "TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer C20 v6", "versions": [{"status": "affected", "version": "0", "lessThan": "Archer C20(US)_V6_250630", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP Link Systems Inc.", "product": "TL-WR845N v4", "versions": [{"status": "affected", "version": "0", "lessThan": "TL-WR845N(UN)_V4_250401", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer MR200 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "Archer MR200(EU)_V5.20_1.3.0 Build 260319", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-27T21:16:47.457", "references": [{"url": "https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/en/support/download/archer-mr200/v5/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/en/support/download/tl-wr845n/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/in/support/download/archer-c20/v6/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/in/support/download/archer-mr200/v5/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/in/support/download/tl-wr845n/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/in/support/download/tl-wr850n/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/archer-c20/v6/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5210/", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "A hardcoded credential\nvulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5). \u00a0Authentication-related credential material is\nembedded within a password file in the firmware image and may be recovered\nthrough firmware analysis.\n\n\n\n\n\nSuccessful\nexploitation could result in unauthorized access to privileged functions on\naffected devices."}], "lastModified": "2026-07-28T16:20:10.853", "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}