CVE-2026-12001

EUVD-2026-49587
A hardcoded credential
vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5).  Authentication-related credential material is
embedded within a password file in the firmware image and may be recovered
through firmware analysis.





Successful
exploitation could result in unauthorized access to privileged functions on
affected devices.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware
https://www.tp-link.com/en/support/download/archer-mr200/v5/#Firmware
https://www.tp-link.com/en/support/download/tl-wr845n/#Firmware
https://www.tp-link.com/in/support/download/archer-c20/v6/#Firmware
https://www.tp-link.com/in/support/download/archer-mr200/v5/#Firmware
https://www.tp-link.com/in/support/download/tl-wr845n/#Firmware
https://www.tp-link.com/in/support/download/tl-wr850n/#Firmware
https://www.tp-link.com/us/support/download/archer-c20/v6/#Firmware
https://www.tp-link.com/us/support/faq/5210/