CVE-2026-5039

highpriority · track · 35EPSS 0.002 · 10 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.21% (10th) EPSS

CVSS 8.8 · high

Is it mine?

6 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_it · nvd

EPSS · scored 2026-10-21

TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the key predictable if device is left in default configuration. A network-adjacent attacker can exploit this weakness to gain unauthorized access to the protocol, read debug data, modify certain device configuration values, and trigger device reboot, resulting in loss of integrity and a denial-of-service condition.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedTL-WR841N v13cisa_csaf_it
Fixed in 0.9.1 Build 20231120 Rel.62366.
https://www.tp-link.com/us/support/faq/4905/

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.4–8.8

v3.18.8highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.3highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Hsecondary · CISA US

v4.06.1mediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.06.1mediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary

v4.02.4lowCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1394USCWE-1394US

affected products (6)

Products and version ranges known to be affected.

TP-Link Systems Inc. TL-WR841N v13 0.9.1 Build 20231120 Rel.62366all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. TL-WR841N v13 <0.9.1 Build 20231120 Rel.62366all versionscisa_csaf_itUS
TP-Link Systems Inc. TL-WR841N v13all versionsfixedcisa_csaf_itUS
TP-Link Systems Inc. TL-WR841N v13< 0.9.1 Build 20231120 Rel.62366cisa_csaf_itUS
TP-Link Systems Inc. TL-WL841N v130 → 0.9.1 Build 20231120 Rel.62366enisa_euvdEU
tp-link tl-wr841n firmware< 231120nvdUScpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

VA-26-119-02TP-Link WR841N Router multiple vulnerabilities2026-04-29csaf · cisa_csaf_itUS
Multiple TP-Link products (TP-Link Archer C20 V5, Archer C20 6.0, Archer AX53 v1.0 and TL-WR841N v13) are affected by multiple vulnerabilities. The most severe of these vulnerabilities could allow an adjacent, unauthenticated attacker to execute administrative commands.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_it nvd NVD CVE.org MITRE

published 2026-04-23modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan