CVE-2026-5039 describes a vulnerability in the TP-Link TL-WR841N v13 router where the TDDPv2 debug protocol uses DES-CBC encryption with a cryptographic key derived from default web management credentials. This design flaw makes the key predictable if the device is left with default credentials. A network-adjacent attacker can exploit this to gain unauthorized access to the debug protocol, read debug information, alter certain device configuration values, and trigger device reboots. The vulnerability impacts device integrity and availability, leading to denial-of-service conditions. The CVSS 4.0 vector indicates low attack complexity, no privileges required, no user interaction, and high impact on integrity and availability. No patch or official remediation has been published by TP-Link as of the current data.

An attacker positioned on the same network as the vulnerable device can exploit the predictable cryptographic key to access the debug protocol. This allows reading sensitive debug data, modifying some device configurations, and forcing device reboots. The consequences include loss of device integrity and denial-of-service conditions. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published, users should avoid leaving the device in its default configuration, particularly default web management credentials, to reduce risk. Network segmentation to limit access to the device's management interfaces may also help mitigate exposure until a patch is available.