PT-2026-28644 · Tp Link · Tl-Wr850N

Published 2026-03-26 · Updated 2026-05-26 · CVE-2026-4346

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TL-WR850N version 3

Description The issue allows for the storage of administrative and Wi-Fi credentials in cleartext within a region of the device’s flash memory. The serial interface remains enabled and is protected by weak authentication. An attacker with physical access and the ability to connect to the serial port can retrieve sensitive information, including the router’s management password and wireless network key. Successful exploitation can lead to full administrative control of the device and unauthorized access to the associated wireless network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2026-4346

Affected Products

Tl-Wr850N

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-4346 · Security Note
• https://tp-link.com/in/support/download/tl-wr850n/#Firmware · Patch
• https://tp-link.com/us/support/faq/5034 · Vendor Advisory
• https://twitter.com/CVEnew/status/2037280512499474902 · Twitter Post
• https://twitter.com/mqst_/status/2059265798016000247 · Twitter Post