Cleartext Credential Storage Vulnerability in TL-WR850N by TP-Link

CVE-2026-4346

What is CVE-2026-4346?

CVE-2026-4346 is a vulnerability found in the TL-WR850N router model produced by TP-Link Systems Inc. This issue arises from the device’s method of storing administrative and Wi-Fi credentials as cleartext within its flash memory. The vulnerability is particularly concerning because the serial interface remains enabled and is protected by weak authentication measures. If an attacker gains physical access to the device and connects to the serial port, they can extract sensitive data, such as the router's management password and Wi-Fi network key. Successful exploitation allows the attacker to gain full administrative control over the router, creating the potential for unauthorized access to the entire associated wireless network.

Potential impact of CVE-2026-4346

1. Unauthorized Network Access: If attackers successfully exploit this vulnerability, they can gain unauthorized access to the wireless network, leading to potential data breaches and interception of sensitive communications.

2. Complete Device Control: Obtaining administrative control over the router allows attackers to manipulate network settings, alter firewall configurations, and disrupt connectivity, which can affect an organization's operational capabilities.

3. Increased Risk of Further Attacks: With access to the network, attackers could leverage the compromised router to launch additional malicious activities, such as deploying malware within the network or perpetrating further attacks on connected devices.

References