CVE-2026-12001mediumCWE-798

CVE-2026-12001: medium-severity vulnerability in TP Link Systems Inc. TL-WR845N v4

Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

Published · Updated

Follow this CVE+ Monitor Archer C20+ Monitor Archer MR200

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.2epss 0.3%
A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5).  Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
TP Link Systems Inc. · TL-WR845N v4TP Link Systems Inc. · TL-WR902AC v4TP-Link Systems Inc. · Archer C20 v6TP-Link Systems Inc. · Archer MR200 v5TP-Link Systems Inc. · TL-WR850N v3
Related CVEs — TP Link Systems Inc. TL-WR845N v4

In the same product, most dangerous first.

CVE-2026-75616HIGHCommand Injection in Router Web Management InterfaceEPSS 2.8%CVE-2026-11834HIGHUnauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link RoutersEPSS 0.7%CVE-2025-15551MEDIUMLAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845NEPSS 0.4%