CVE-2025-13399

Insecure Encryption in Communication with the Web Interface on TP-Link VX800v

State: Published
Severity: 7.7 High
Published: Jan 29, 2026
Updated: Feb 26, 2026
Reserved: Nov 19, 2025

Description

A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result in high impact to confidentiality, integrity, and availability of transmitted data.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	TPLink

Weaknesses

CWE-331 Insufficient Entropy

Affected Products

Product	Versions
VX800v v1.0TP-Link Systems Inc.	before 800.0.11 (0.11.0 3.0.0 v603c.0 Build 250702)Affected

References

https://www.tp-link.com/de/support/download/vx800v/#Firmwarepatch
https://www.tp-link.com/us/support/faq/4930/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.