CVE-2020-35575

9.8 criticalEPSS 7.6%

A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N, WR1043ND, WR1045ND, WR740N, WR741ND, WR749N, WR802N, WR840N, WR841HP, WR841N, WR842N, WR842ND, WR845N, WR940N, WR941HP, WR945N, WR949N, and WRD4300 devices.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 7.6% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
Published: 2020-12-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tp-link:archer_c5_firmware
tp-link:archer_c7_firmware
tp-link:mr3420_firmware
tp-link:mr6400_firmware
tp-link:wa701nd_firmware
tp-link:wa801nd_firmware
tp-link:wa901nd_firmware
tp-link:wdr3500_firmware
tp-link:wdr3600_firmware
tp-link:we843n_firmware
tp-link:wr1043nd_firmware
tp-link:wr1045nd_firmware
tp-link:wr740n_firmware
tp-link:wr741nd_firmware
tp-link:wr749n_firmware
tp-link:wr802n_firmware
tp-link:wr840n_firmware
tp-link:wr841hp_firmware
tp-link:wr841n_firmware
tp-link:wr842n_firmware
tp-link:wr842nd_firmware
tp-link:wr845n_firmware
tp-link:wr940n_firmware
tp-link:wr941hp_firmware
tp-link:wr945n_firmware
tp-link:wr949n_firmware
tp-link:wrd4300_firmware

References

Check your stack JSON