The TP Link TL‑WR850N v3 router has a flaw that allows clear‑text storage of its management password and wireless network key in flash memory while the serial port is enabled. The credential data is stored in a small section accessible through the serial interface, which is protected only by weak authentication. If an attacker can physically connect to that port, they can read the credentials. Possession of those credentials gives full administrative control of the router and access to the associated Wi‑Fi network. This weakness is a classic example of CWE‑312, clear‑text storage of sensitive information.

TP Link Systems Inc. TL‑WR850N model version 3. No other models or firmware revisions are reported as vulnerable.

The vulnerability has a CVSS base score of 5.1, indicating moderate severity. EPSS is below 1 %, suggesting exploitation is currently unlikely. It is not listed in CISA’s Known Exploited Vulnerabilities catalog. The primary attack vector requires physical access to the device to connect to the serial interface; no remote exploitation is documented. Thus, the risk is largely confined to environments where an attacker can reach the hardware, such as factories, access‑control setups, or at home where the user may inadvertently expose the port.