CVE-2026-5039
TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the key predictable if device is left in default configuration. A network-adjacent attacker can exploit this weakness to gain unauthorized access to the protocol, read debug data, modify certain device configuration values, and trigger device reboot, resulting in loss of integrity and a denial-of-service condition.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.1
- CVSS vector
- CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.13%
- CWE
- CWE-1394
- Published
- 2026-04-23
- Last modified
- 2026-04-28
Affected products
- TP-Link Systems Inc. TL-WL841N v13
Weakness type
Related vulnerabilities
- CVE-2026-75870 — Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret
- CVE-2026-54887 — DTLS server cookie bypass during startup window due to empty initial cookie secret
- CVE-2026-20709 — Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver...
- CVE-2026-2215 — rachelos WeRSS we-mp-rss JWT auth.py default key
- CVE-2026-25815 — Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device...
- CVE-2025-41742 — Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components
- CVE-2025-41744 — Sprecher Automation: SPRECON-E series has static default key material for TLS connections
- CVE-2025-55049 — Use of Default Cryptographic Key (CWE-1394)