Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2023-50224

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

Affects TP-Link TL-WR841N routers through the httpd web service on TCP port 80. The fix is firmware EU_V12_230317, but it is only a partial fix.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in EU_V12_230317
None on Exploit-DB, Metasploit or GitHub

Summary

The affected product is the TP-Link TL-WR841N wireless router. A nearby attacker on the same network can exploit a flaw in its web management service to obtain sensitive information, such as stored credentials, without logging in, which could then be used to take further control of the device.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • TP-Link TL-WR841N

    3.16.9 build 200409, V8, V9, V10, V11, V12

  • TP-Link TL-WR841ND

    V8, V9, V10, V11, V12

  • TP-Link TL-MR6400

    V1, V2

  • TP-Link Archer C5

    V2

  • TP-Link Archer C7

    V2, V3

  • TP-Link TL-WDR3600

    V2

  • TP-Link TL-WDR4300

    V1

  • TP-Link TL-WDR3500

    V2

  • TP-Link TL-WR740N

    V4, V5, V6, V7

  • TP-Link TL-WR741ND

    V4, V5, V6

  • TP-Link TL-WR749N

    BR 6.0, BR 7.0

  • TP-Link TL-MR3420

    V2, V3, V4

  • TP-Link TL-WR1043ND

    V2, V3, V4

  • TP-Link TL-WR1045ND

    RU V2

  • TP-Link TL-WR840N

    V2, V3

  • TP-Link TL-WR842N

    V2, V3, V4

  • TP-Link TL-WR842ND

    V2, V3, V4

  • TP-Link TL-WR845N

    V1, V2

  • TP-Link TL-WR941ND

    V5, V6

  • TP-Link TL-WR945N

    V1

  • TP-Link TL-WA801ND

    V3, V4

  • TP-Link TL-WA901ND

    V3, V4, V5

References 3

zerodayinitiative.com

tp-link.com

FAQ

Questions about CVE-2023-50224

What does this mean?

The flaw lets an attacker disclose stored credentials from the router's httpd service, which may lead to further compromise of the device.Source: zerodayinitiative.com, tp-link.com

Am I affected, and how do I check?

The checked facts name the TP-Link TL-WR841N and several related TP-Link models but give no version ranges. The flaw is in the httpd service, which listens on TCP port 80 by default, so a reader can compare the firmware version shown in the router's admin interface with EU_V12_230317.Source: zerodayinitiative.com, tp-link.com

What should I do about it?

Install firmware EU_V12_230317 from TP-Link's TL-WR841N download page. Until it is installed, disable remote management and unnecessary services.Source: zerodayinitiative.com, tp-link.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-09-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data

Is the fix complete?

The fix is marked as partial in the checked facts, so the flaw may not be fully fixed by EU_V12_230317. The facts do not say which part remains unfixed.Source: zerodayinitiative.com, tp-link.com