Is CVE-2026-12001 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12001 being exploited in the wild.

How severe is CVE-2026-12001?

Informational severity, with a CVSS score of 5.2, published 27 July 2026.

Which products and versions are affected?

TP-Link Archer C20 Before Archer C20(US)_V6_250630; TP-Link Archer MR200 Before Archer MR200(EU)_V5.20_1.3.0 Build 260319; TP-Link TL-WR845N Before TL-WR845N(UN)_V4_250401.

Is there a fix for CVE-2026-12001?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12001 attacked?

It is attacked with physical access, in a network appliance.

Am I affected by CVE-2026-12001?

Check whether you run TP-Link Archer C20, TP-Link Archer MR200 or TP-Link TL-WR845N at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12001: TP-Link Multiple Routers hardcoded credentials in firmware

CVE-2026-12001 · Severity: info · CVSS 5.2 · Published 2026-07-27

A security vulnerability exists in several TP-Link router models where sensitive login credentials are permanently stored within the device's internal software. An individual with physical access to the device or its software files could extract these credentials to gain unauthorized access to restricted management settings. This could allow an attacker to modify network configurations or disrupt the device's operation.

Vendors: TP-Link.

Quick answers

Is CVE-2026-12001 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12001 being exploited in the wild.
How severe is CVE-2026-12001?: Informational severity, with a CVSS score of 5.2, published 27 July 2026.
Which products and versions are affected?: TP-Link Archer C20 Before Archer C20(US)_V6_250630; TP-Link Archer MR200 Before Archer MR200(EU)_V5.20_1.3.0 Build 260319; TP-Link TL-WR845N Before TL-WR845N(UN)_V4_250401.
Is there a fix for CVE-2026-12001?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12001 attacked?: It is attacked with physical access, in a network appliance.
Am I affected by CVE-2026-12001?: Check whether you run TP-Link Archer C20, TP-Link Archer MR200 or TP-Link TL-WR845N at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A hardcoded credential vulnerability (CWE-798) exists in the firmware of multiple TP-Link router models, including the TL-WR845N, TL-WR850N, Archer C20, and Archer MR200. Authentication-related material is embedded within a password file in the firmware image. An attacker can recover these credentials through firmware analysis, which typically requires physical access to the device or obtaining the firmware image. Successful exploitation allows the attacker to bypass standard authentication and access privileged management functions. TP-Link has released updated firmware versions to address this issue.

Affected products

TP-Link TL-WR845N v4 Before TL-WR845N(UN)_V4_250401
TP-Link TL-WR845N v3 Before TL-WR845N(IN)_V3.48_3.16.0 Build 260422_2048
TP-Link Archer C20 v6 Before Archer C20(US)_V6_250630
TP-Link Archer MR200 v5 Before Archer MR200(EU)_V5.20_1.3.0 Build 260319

Timeline

2026-07-27: disclosed
2026-07-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.