CVE Tools
Track your stack

CVE-2026-12001

Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

No known exploitation. EPSS puts it in the 28th percentile. Fixed versions are out.

CVSS —Not scoredEPSS percentile28th0.3% chance in 30 daysCISA KEVNot listedNo confirmed exploitation
No public exploit knownFix5 products6 fixed builds listed below
Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published Updated Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

  • TP-Link Systems Inc. TL-WR850N v3Affected: < TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048Upgrade to: TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048Stated by: CVE record
  • TP-Link Systems Inc. Archer C20 v6Affected: < Archer C20(US)_V6_250630Upgrade to: Archer C20(US)_V6_250630Stated by: CVE record
  • TP Link Systems Inc. TL-WR845N v4Affected: < TL-WR845N(UN)_V4_250401Upgrade to: TL-WR845N(UN)_V4_250401Stated by: CVE record
  • TP-Link Systems Inc. Archer MR200 v5Affected: < EU_V5.20_1.3.0 Build 260319Upgrade to: EU_V5.20_1.3.0 Build 260319Stated by: CVE record
  • TP Link Systems Inc. TL-WR902AC v4Affected: < US_V4_0.9.1 Build 260810Upgrade to: US_V4_0.9.1 Build 260810Affected: < EU_V4_0.9.3 Build 260728Upgrade to: EU_V4_0.9.3 Build 260728Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

What it is

From the CVE record

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5).  Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS28th
CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 28th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 15 days, from the signal feeds we watch.

  1. Record updated
  2. Record updated
  3. Publishedweakness classified, att&ck mapped, record updated

Affected products

Technical detail

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Sources

References in the record

And 8 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for TL-WR850N v3, not every advisory.