Yes, every router I can remember having recently, as well as stand alone wireless access points, have had the option to choose the type of security. The fact that the P9 doesn't have this and is also using WPA is a major over sight by TP Link. 

It needs to be fixed as soon as possible so it is secure for everyone that currently uses them. I can't imagine it being difficult to do, other TP Link access points have this option, but judging by the time it took to get the latest firmware it might be a while.

I'm hoping that they will see this as a MAJOR SECURITY RISK and at least get an update to patch this as soon as possible.

I find it difficult to comprehend how they can release these access points without this option knowing how insecure WPA is.

@TP-Link_Deco 

Thank you very much. 

The problem is that nobody knows this and with it every network is highly exposed to security exploits, since it broadcasts the both security protocols and most of the modern devices will display it as WPA2, but after further inspection the WPA is present. 

I have a NAS which is local only with a lot of files being there and I cannot use a TP-Link product with such security flaw, since I have 20+ WiFi networks around me. WPA being used exposes my network to many who can potentially use it in order to gain access to my network and devices on it. 

Everybody that lives in a building has the same problem without even being aware of it. 

I can only hope that nothing bad will happen and nobody will be damaged because of this. 

@TP-Link_Deco 

Thanks for the update.

It would be great to get a timeline on when this will be implemented.

As @LaMpiR  mentioned, I don't believe that setting this option on a client is a suitable solution at all, as the network is still being broadcast. It isn't so much about securing the devices you want on the network, more that you don't want rouge devices using the security flaws in WPA to join the network without proper authorization.

Again, thanks for the update but it would be appreciated if we could get information on the change request, if it has been approved, and when we can expect it to be implemented. 

@TP-Link_Deco 

"we cannot only add just one single feature in the new firmware release"

None of us would have bought this product had we known basic WPA is always enabeld, who will recommend this product knowing this?

@TP-Link_Deco 

Has there been any update to this?

As a 'high priority security issue', it would be good to get an update. 

Looking at other posts, it looks like this is going to be a big issue for TP-Link unless it is fixed by September with the release of iOS 14 that informs users that the network is insecure as it isn't using WPA2-AES. 

Please give us this option and the ability to turn off WPS. It doesn't matter if a version of firmware doesn't include any other settings or features other than setting the security to only WPA2-AES and disabling WPS, because judging by this post, as well as other posts on the forum, this is an important consideration to users as they are rightly worried about the security of their network on hardware that should have this feature already. 

Please could you provide an ETA or the current status of this request and if it is being worked on. 

Well, it's good to see how serious TP Link are taking security.

No updates or ETAs on what is an important fix, which will no doubt cause more topics in here and more news when iOS updates and lets more people know how insecure the default is on these devices with no way of disabling age old insecure wireless protocols. 

Checking in on this.

The answers above are not acceptable.  If it is not addressed quickly everyone needs to be warned not to use these products. 

@unicaller 

Yes I agree. I can't believe how irresponsible this is from a large company like TP-Link. 

WPS and any security less than WPA2-AES should be optional with a massive warning. But the fact that it's enabled by default without any option to turn it off is a major issue and security risk. 

I appreciate they've acknowledged it in this thread, but with no confirmation or ETAs it's just empty promises at the moment.