Read the docs
TI-2026-04397 Aliases CVE-2026-5039GHSA-f7mq-68q8-xqv6

Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N

Priority LOW 26CWE-1394Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the key predictable if device is left in default configuration. A network-adjacent attacker can exploit this weakness to gain unauthorized access to the protocol, read debug data, modify certain device configuration values, and trigger device reboot, resulting in loss of integrity and a denial-of-service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0013 2nd percentileScored 2026-11-07
Fix Fixed TL-WL841N v13 (TP-Link Systems Inc.): 0.9.1 Build 20231120 Rel.62366

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTL-WL841N v13before 0.9.1 Build 20231120 Rel.623660.9.1 Build 20231120 Rel.62366Patch availableCNA
  • TL-WL841N v13 VendorTP-Link Affected before 0.9.1 Build 20231120 Rel.62366 Fixed in 0.9.1 Build 20231120 Rel.62366 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:*before 231120VulnerableTP-Link
cpe:2.3:h:tp-link:tl-wr841n:13.0:*:*:*:*:*:*:*13.0Running onTP-Link
  • cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:* Versions before 231120 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tl-wr841n:13.0:*:*:*:*:*:*:* Versions 13.0 Running on ·TP-Link

Remediation

  • Fix · CNA TL-WL841N v13 (TP-Link Systems Inc.) Fixed in 0.9.1 Build 20231120 Rel.62366

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5039
  2. 2026-10-03 Alias added: GHSA-f7mq-68q8-xqv6

References

Patch 1

  • TI-2023-16571 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain… KEVCVSS 3.1HIGH 8.8
  • TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
  • TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
  • TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
  • TI-2018-08378 An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608… CVSS 3.0CRITICAL 9.8
  • TI-2026-02790 Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N CVSS 4.0HIGH 8.5
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences