Is there a patch available for EUVD-2026-49587?

Yes, a patch is available for EUVD-2026-49587. Update the affected software to the latest version immediately.

TP-Link Routers EUVD-2026-49587

Q: What is the CVSS score of EUVD-2026-49587?

EUVD-2026-49587 has a CVSS 4.0 base score of 5.2 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-12001 MEDIUM

Use of Hard-coded Credentials (CWE-798)

2026-07-27 TPLink

GHSA-884r-qm45-3j9g

Authentication Bypass TP-Link Tl Wr850N V3 Archer C20 V6 Tl Wr845N V4 Archer Mr200 V5

5.2

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

5.2 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Physical access required (AV:L), no privileges or interaction needed, high confidentiality and availability impact, no integrity impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 20:45 vuln.today

DescriptionCVE.org

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis.

Successful exploitation could result in unauthorized access to privileged functions on affected devices.

AnalysisAI

Hardcoded credentials in TP-Link router firmware allow attackers with physical access to gain unauthorized access to privileged functions, potentially leading to full device compromise. Affected models include TL-WR845N v4, TL-WR850N v3, Archer C20 v6, and Archer MR200 v5. No evidence of active exploitation or public exploit code exists at this time, and the physical access requirement limits remote exploitation risk.

Technical ContextAI

The vulnerability is a classic hardcoded credential issue (CWE-798) where authentication credentials are embedded in a password file within the firmware image. An attacker with physical access or the ability to extract and analyze the firmware can recover these static credentials and bypass authentication to access privileged functions. The CVSS vector (AV:P/AC:L/AT:N/PR:N/UI:N) confirms physical access is required, making remote exploitation impossible. CPE data identifies exact affected products: TL-WR845N v4 (cpe:2.3:a:tp_link_systems_inc.:tl-wr845n_v4:*), TL-WR850N v3 (cpe:2.3:a:tp-link_systems_inc.:tl-wr850n_v3:*), Archer C20 v6 (cpe:2.3:a:tp-link_systems_inc.:archer_c20_v6:*), and Archer MR200 v5 (cpe:2.3:a:tp-link_systems_inc.:archer_mr200_v5:*).

RemediationAI

The primary fix is to update firmware to the latest versions available from TP-Link: TL-WR845N(UN)_V4_250401, TL-WR850N(IN)_V3.48_3.16.0 Build 260422_2048, Archer C20(US)_V6_250630, and Archer MR200(EU)_V5.20_1.3.0 Build 260319. Firmware downloads are available at TP-Link's support pages (e.g., https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware and others listed in references). No workaround can fully mitigate the hardcoded credential issue without patching; however, restricting physical access to devices and disabling remote management features can reduce exposure. Note that applying a patch overwrites the firmware image, removing the hardcoded credentials.