CVE-2025-13399 - CVE House
Back to Database
Status published High CVE-2025-13399

Insecure Encryption in Communication with the Web Interface on TP-Link VX800v

Vulnerability Description

A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result in high impact to confidentiality, integrity, and availability of transmitted data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-13399

Credits & Attribution

No credits recorded in the NVD database.

References

More from TP-Link Systems Inc.

View All →
CVE-2025-9961
Authenticated RCE by CWMP binary
High 8.6
CVE-2025-9522
Blind Server-Side Request Forgery (SSRF) in Omada Controller
Medium 5.1
CVE-2025-9521
Password Confirmation Bypass in Omada Controller
Low 2.1
CVE-2025-9520
IDOR Leading to Owner Account Hijacking in Omada Controller
High 8.3
CVE-2025-9377
Authenticated RCE via Parental Control command injection
High 8.6

Affected Vendor

TP-Link Systems Inc.

View all reports →

Affected Software

VX800v v1.0
Vulnerable Versions:
0

Timeline

Official Publish: January 29th, 2026
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-331

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.