This vulnerability (CVE-2026-12001) is classified as CWE-798, indicating the use of hardcoded credentials in the firmware of several TP-Link router models such as TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6, and Archer MR200 v5. The hardcoded authentication credentials are embedded within a password file inside the firmware image, making them recoverable through firmware analysis. Successful exploitation may lead to unauthorized privileged access on the affected devices. The CVSS 4.0 base score is 5.2, reflecting a medium severity with attack vector as physical, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and availability. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

The vulnerability allows an attacker who can analyze the firmware image to recover hardcoded credentials, potentially enabling unauthorized access to privileged functions on the affected TP-Link routers. This could compromise device security, confidentiality, and availability. However, the attack vector is physical, which limits remote exploitation possibilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit physical access to affected devices and monitor for vendor updates. No official remediation or temporary fixes are currently documented.