What’s Vulnerable › Vulnerabilities

CVE-2025-13399: Insecure Encryption in Communication with the Web Interface on TP-Link VX800v

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-29 · updated 2026-06-17
• Weakness: CWE-331

Description

A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result in high impact to confidentiality, integrity, and availability of transmitted data.

Affected products

• TP-Link Systems Inc. VX800v v1.0: before 800.0.11 — fixed in 800.0.11

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. VX800v v1.0 800.0.11. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/de/support/download/vx800v/#Firmware
• https://www.tp-link.com/us/support/faq/4930/

Get alerted when CVE-2025-13399 or the next vulnerability affects your stack