A hardcoded credential flaw exists in the firmware of several TP‑Link routers, including TL‑WR845N v4, TL‑WR850N v3, TL‑WR902AC v4, Archer C20 v6, and Archer MR200 v5. The firmware contains an embedded password file that holds authentication‑related credential material. Through firmware analysis or by downloading the image from the vendor’s site, an attacker can recover this password. Successful exploitation permits unauthorized access to the device’s privileged management functions, potentially allowing configuration changes, traffic interception, or other malicious activities.

The issue affects TP‑Link routers: TL‑WR845N v4, TL‑WR850N v3, TL‑WR902AC v4, Archer C20 v6, and Archer MR200 v5.

The CVSS base score is 5.2, indicating a moderate severity. The EPSS score is <1% (0.00251), which indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is possible once the firmware image or recovered credentials are obtained, which can be done through firmware analysis or by downloading the firmware from the vendor’s site. After gaining the credentials, an attacker can remotely log into the administrative interface to adjust settings or intercept traffic. At minimum, an attacker needs access to the firmware image or the ability to recover credentials, and network access to the device. Based on the description, it is inferred that network access to the device is required for remote management, a prerequisite that is logically necessary but not explicitly stated in the input.