TP-Link TL-WR841N CVE-2026-5039

TDDPv2 (TP-Link Device Debug Protocol version 2) is a proprietary network-level debug interface present on TP-Link consumer routers. The protocol encrypts communications using DES-CBC (Data Encryption Standard in Cipher Block Chaining mode), a symmetric cipher with a 56-bit key that was deprecated by NIST in 2005 due to its small key size and vulnerability to brute-force attacks. More critically, CWE-1394 (Use of Default Cryptographic Key) identifies the root cause: the encryption key is algorithmically derived from the device's default web administration credentials rather than a device-unique or randomly generated secret. On devices that ship with factory-default credentials - and that users have never changed - this makes the TDDPv2 key globally predictable. Affected product per CPE is cpe:2.3:a:tp-link_systems_inc.:tl-wl841n_v13 (note: CPE string contains a typo 'tl-wl841n' vs the actual product designation 'tl-wr841n' - both refer to the same device). The CVSS 4.0 vector's AT:P (Attack Prerequisites: Present) metric formally encodes that the specific-configuration prerequisite - default credentials remaining unchanged - must be satisfied for exploitation.