Vulnerability · Published Jan 29, 2026 · Assigned by TPLink
CVE-2025-13399Insecure Encryption in Communication with the Web Interface on TP-Link VX800v
High 7.7
In plain English
A high-severity security flaw in VX800v v1.0 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result in high impact to confidentiality, integrity, and availability of transmitted data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | VX800v v1.0 | 0 – before 800.0.11 (0.11.0 3.0.0 v603c.0 Build 250702) |
Weakness: CWE-331 · Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N