VA-26-119-02: TP-Link WR841N Router multiple vulnerabilities

CISA's summary

Risk Evaluation: Multiple TP-Link products (TP-Link Archer C20 V5, Archer C20 6.0, Archer AX53 v1.0 and TL-WR841N v13) are affected by multiple vulnerabilities. The most severe of these vulnerabilities could allow an adjacent, unauthenticated attacker to execute administrative commands.

Products, as the advisory lists them

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

• CVE-2026-0834 — Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13 · CWE-290

  Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability. Fixed in Archer C20 V6_251031, Archer C20 EU_V5_260317, Archer C20 US_V5_260419, Archer AX53 V1_251215, TL-WR841N v13 0.9.1 Build 20231120 Rel.62366.

• CVE-2026-5039 — Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N · CWE-1394

  TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the key predictable if device is left in default configuration. A network-adjacent attacker can exploit this weakness to gain unauthorized access to the protocol, read debug data, modify certain device configuration values, and trigger device reboot, resulting in loss of integrity and a denial-of-service condition. Fixed in TL-WR841N v13 0.9.1 Build 20231120 Rel.62366.

The advisory's legal notice

All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).

Sources

• The CSAF document (JSON)

DeSpy's copy of this version is dated 2026-09-28.