EUVD-2026-49587
GHSA-884r-qm45-3j9g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain physical device access
-
DeliveryExtract firmware image
-
ExploitRecover hardcoded credential
-
ExecutionAuthenticate as admin
-
PersistAccess privileged functions
-
ImpactImpact device confidentiality and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires physical access to the device (AV:P) or the ability to analyze a copy of the firmware image. The attacker does not need any prior authentication or user interaction. Limits: remote exploitation is not possible; the attacker must have possession of the device or its firmware. The vulnerability is present in default firmware configurations-no special settings need to be enabled. |
| Impact | The CVSS score of 5.2 reflects moderate severity, but the physical attack vector (AV:P) significantly reduces real-world risk in typical deployments where routers are not physically exposed to attackers. No EPSS score or CISA KEV listing was provided, nor any mention of public exploit code, suggesting exploitation is not widespread. However, if an attacker gains physical access (e.g., stolen device, insider threat), the hardcoded credentials provide a reliable authentication bypass. The SSVC framework would rate exploitation as 'none' based on available data. The absence of EPSS and KEV data limits automated risk assessment, but the physical access requirement is the key risk-limiting factor. The vulnerability should be prioritized for patching where devices are in physically insecure environments. |
| Exploit ScenarioDerived | An attacker obtains physical access to an unpatched TP-Link router (e.g., from a discarded or stolen device). They extract the firmware using standard tools, recover the hardcoded administrator password from the embedded password file, then log into the router's web interface with full administrative privileges to modify settings, exfiltrate network traffic, or install custom firmware. No public exploit code has been reported for this CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Hardcoded credentials in TP-Link router firmware allow attackers with physical access to gain unauthorized access to privileged functions, potentially leading to full device compromise. Affected models include TL-WR845N v4, TL-WR850N v3, Archer C20 v6, and Archer MR200 v5. No evidence of active exploitation or public exploit code exists at this time, and the physical access requirement limits remote exploitation risk.
RemediationAI
The primary fix is to update firmware to the latest versions available from TP-Link: TL-WR845N(UN)_V4_250401, TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048, Archer C20(US)_V6_250630, and Archer MR200(EU)_V5.20_1.3.0 Build 260319. Firmware downloads are available at TP-Link's support pages (e.g., https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware and others listed in references). No workaround can fully mitigate the hardcoded credential issue without patching; however, restricting physical access to devices and disabling remote management features can reduce exposure. Note that applying a patch overwrites the firmware image, removing the hardcoded credentials.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic hardcoded credential issue (CWE-798) where authentication credentials are embedded in a password file within the firmware image. An attacker with physical access or the ability to extract and analyze the firmware can recover these static credentials and bypass authentication to access privileged functions. The CVSS vector (AV:P/AC:L/AT:N/PR:N/UI:N) confirms physical access is required, making remote exploitation impossible. CPE data identifies exact affected products: TL-WR845N v4 (cpe:2.3:a:tp_link_systems_inc.:tl-wr845n_v4:*), TL-WR850N v3 (cpe:2.3:a:tp-link_systems_inc.:tl-wr850n_v3:*), Archer C20 v6 (cpe:2.3:a:tp-link_systems_inc.:archer_c20_v6:*), and Archer MR200 v5 (cpe:2.3:a:tp-link_systems_inc.:archer_mr200_v5:*).
Know when Archer C20 V6 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Physical access required (AV:L), no privileges or interaction needed, high confidentiality and availability impact, no integrity impact.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
DescriptionCVE.org
A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis.
Successful exploitation could result in unauthorized access to privileged functions on affected devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Archer C20 V6
View allCommand injection in TP-Link Archer and TL-MR series routers allows an adjacent unauthenticated attacker on the same bro
OS command injection in the TP-Link Archer C20 v6 web management interface enables an authenticated administrator to exe
Exploit-DB