What’s Vulnerable › Vulnerabilities
CVE-2023-50224: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2025-09-03
- EPSS: 20.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-05-03 · updated 2026-09-03
- Weakness: CWE-290
Description
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
Affected products
- TP-Link Archer C1900 Firmware: before 1_260428 — fixed in 1_260428
- TP-Link Archer C5 Firmware: from 2_150130 before 2_260429 — fixed in 2_260429
- TP-Link Systems Inc. Archer C7 v5 and v5.8: from 2_131217 before 2_241108; 3_150508 — fixed in 2_241108
- TP-Link Mr3420 Firmware: all versions
- TP-Link Mr6400 Firmware: all versions
- TP-Link Tl-Mr3020 Firmware: all versions
- TP-Link Tl-Mr3220 Firmware: all versions
- TP-Link Tl-Wdr3600 Firmware: all versions
- TP-Link Tl-Wdr4300 Firmware: all versions
- TP-Link Tl-Wr710N Firmware: all versions
- TP-Link TL-WR740N: all versions
- TP-Link Tl-Wr741Nd Firmware: all versions
- TP-Link Tl-Wr743Nd Firmware: all versions
- TP-Link Tl-Wr810N Firmware: all versions
- TP-Link Tl-Wr840N Firmware: all versions
- TP-Link TL-WR841N: from 11_150616 before 11_211209; from 12_160624 before 12_230317 — fixed in 11_211209, 12_230317
- TP-Link TL-WR841ND: all versions
- TP-Link Tl-Wr843N Firmware: all versions
- TP-Link TL-WR902AC: 1_160905, 1_170628
- TP-Link TL-WR940N: from 5_161019 through 5_220801; from 6_170325 before 6_250925 — fixed in 6_250925
- TP-Link Tl-Wr940N Plus Firmware: 6_170704, 6_171115
- TP-Link Tl-Wr941Nd Firmware: from 6_150206 before 6_220610 — fixed in 6_220610
- TP-Link Wa701Nd Firmware: all versions
- TP-Link Wa801Nd Firmware: all versions
- TP-Link Wa901Nd Firmware: from 6_191127 before 6_220701; from 4_151029 before 4_201030; 5_160929 — fixed in 4_201030, 6_220701
- TP-Link Wdr3500 Firmware: all versions
- TP-Link Wr1043Nd Firmware: all versions
- TP-Link Wr1045Nd Firmware: all versions
- TP-Link Wr749N Firmware: all versions
- TP-Link Wr802N Firmware: all versions
How to fix
Upgrade to a fixed version: TP-Link Archer C1900 Firmware 1_260428; TP-Link Archer C5 Firmware 2_260429; TP-Link Systems Inc. Archer C7 v5 and v5.8 2_241108; TP-Link TL-WR841N 11_211209, 12_230317; TP-Link TL-WR940N 6_250925; TP-Link Tl-Wr941Nd Firmware 6_220610; TP-Link Wa901Nd Firmware 4_201030, 6_220701; TP-Link Wr941Hp Firmware 1_211210. Check the vendor advisory for mitigations.
References
- https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware
- https://www.tp-link.com/us/support/faq/5058/
- https://www.zerodayinitiative.com/advisories/ZDI-23-1808/
- https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware
- https://www.zerodayinitiative.com/advisories/ZDI-23-1808/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-50224
Get alerted when CVE-2023-50224 or the next vulnerability affects your stack