Summaryinfo

A vulnerability marked as problematic has been reported in TP-Link TL-WR850N up to 3_0.9.1 Build 251204. Affected by this vulnerability is an unknown functionality of the component Serial Interface. This manipulation causes cleartext storage. The identification of this vulnerability is CVE-2026-4346. It is feasible to perform the attack on the physical device. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in TP-Link TL-WR850N up to 3_0.9.1 Build 251204 and classified as problematic. Affected by this vulnerability is an unknown code of the component Serial Interface. The manipulation with an unknown input leads to a cleartext storage vulnerability. The CWE definition for the vulnerability is CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. As an impact it is known to affect confidentiality. The summary by CVE is:

The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of the device’s flash memory while the serial interface remains enabled and protected by weak authentication. An attacker with physical access and the ability to connect to the serial port can recover sensitive information, including the router’s management password and wireless network key. Successful exploitation can lead to full administrative control of the device and unauthorized access to the associated wireless network.

The weakness was shared by Anirudh Tarikere Shankarappa. The advisory is shared at tp-link.com. This vulnerability is known as CVE-2026-4346 since 03/17/2026. The exploitation appears to be easy. An attack has to be approached locally. Additional levels of successful authentication are needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1555 for this issue.

Upgrading to version 3_0.9.1 Build 251205 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-16452). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• TP-Link

Name

• TL-WR850N

Version

• 3_0.9.1 Build 251204

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion