CVE-2026-12001: TP-Link Router Auth Bypass Vulnerability

CVE-2026-12001 Overview

CVE-2026-12001 is a hardcoded credential vulnerability [CWE-798] affecting the firmware of multiple TP-Link consumer routers. The affected models are TL-WR845N v4, TL-WR850N v3, Archer C20 v6, and Archer MR200 v5. Authentication-related credential material is embedded within a password file inside the firmware image. An attacker who obtains and analyzes the firmware can recover these credentials and use them to access privileged functions on affected devices. The issue is scored 5.2 (Medium) under CVSS 4.0, reflecting a physical attack vector combined with high confidentiality and availability impact.

Critical Impact
Recovered hardcoded credentials can grant unauthorized access to privileged router functions, enabling configuration tampering, traffic interception, and persistent device compromise.

Affected Products

TP-Link TL-WR845N v4
TP-Link TL-WR850N v3
TP-Link Archer C20 v6
TP-Link Archer MR200 v5

Discovery Timeline

2026-07-27 - CVE-2026-12001 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-12001

Vulnerability Analysis

The vulnerability stems from credential material stored directly inside a password file within the shipped firmware image. Because the credentials are baked into the firmware, every device running the affected image shares the same authentication secrets. An attacker with access to a firmware download from the vendor's support portal can extract the filesystem, locate the password file, and recover the embedded values.

Once recovered, these credentials can be used to reach privileged functions that are otherwise gated by authentication. The flaw maps to [CWE-798: Use of Hard-coded Credentials], a class of weakness that consistently appears in embedded consumer networking equipment. Exploitation requires physical or local access to the device according to the CVSS 4.0 vector, but firmware analysis itself can be performed offline on any downloaded image.

Root Cause

The root cause is the inclusion of static, non-user-configurable credentials inside a password file distributed as part of the firmware image. Because the file ships with the firmware, the secret is neither device-unique nor rotatable by the end user. Any researcher or attacker who unpacks the firmware, for example with binwalk against the SquashFS root filesystem, can read the credential material with standard tooling.

Attack Vector

An attacker downloads the firmware image from the TP-Link support portal for the target model, unpacks the filesystem, and inspects the embedded password file. Recovered credentials are then presented to the device's authentication interface. Because the CVSS vector specifies AV:P (physical), the practical impact is realized when an attacker has proximity or local network access to the target router. Successful authentication yields access to privileged functions, which can be used to alter DNS settings, modify firewall rules, or persist implants across reboots.

No public proof-of-concept exploit is currently listed for CVE-2026-12001. Refer to the TP-Link FAQ 5210 and per-model firmware download pages for vendor guidance.

Detection Methods for CVE-2026-12001

Indicators of Compromise

Unexpected logins to the router administration interface from LAN or WAN sources that do not match known administrator activity.
Unauthorized changes to DNS servers, DHCP settings, port forwarding rules, or administrator credentials on affected TP-Link models.
Firmware or configuration downgrades performed outside of scheduled maintenance windows.
Outbound traffic from the router itself to unfamiliar hosts, which may indicate a persistence implant using recovered credentials.

Detection Strategies

Compare current router configuration against a known-good baseline for each affected model to identify tampering.
Inspect router system logs, where available, for authentication events tied to privileged functions.
Monitor client devices behind affected routers for signs of DNS redirection or TLS certificate anomalies indicative of interception.

Monitoring Recommendations

Forward router syslog output to a central log collector and alert on administrative logins and configuration changes.
Track DNS resolution behavior from client endpoints and flag deviations from the expected upstream resolvers.
Watch for firmware images or password files being staged on internal hosts, which may indicate offline credential extraction activity.

How to Mitigate CVE-2026-12001

Immediate Actions Required

Identify all TL-WR845N v4, TL-WR850N v3, Archer C20 v6, and Archer MR200 v5 devices in the environment and inventory their current firmware versions.
Restrict physical and management-plane access to affected routers until a vendor-supplied fix is applied.
Disable remote management (WAN-side administration) and limit administrative access to a dedicated management VLAN.
Rotate any Wi-Fi passphrases, administrator passwords, and pre-shared keys configured on the affected devices.

Patch Information

TP-Link publishes firmware updates on the per-model support pages. Review and apply the latest available firmware from the Archer C20 v6 firmware page, the Archer MR200 v5 firmware page, the TL-WR845N firmware page, and the TL-WR850N firmware page. Additional vendor guidance is available in TP-Link FAQ 5210.

Workarounds

Place affected routers behind an additional network boundary and prohibit exposure of administrative services to untrusted networks.
Retire end-of-life models that no longer receive firmware updates and replace them with supported hardware.
Segment IoT and guest traffic from sensitive internal networks so that a compromised router yields minimal lateral reach.

bash

# Configuration example: restrict router management to a specific admin host
# Example iptables rule applied on an upstream firewall protecting the router
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <admin_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP