{"id":"CVE-2023-50224","kind":"vulnerability","aliases":["CVE-2023-50224"],"related":[],"title":"TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability","description":"TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.","summary":"TP-Link TL-WR841N home routers have an authentication bypass in the httpd web service on TCP port 80, caused by spoofing. An attacker on the network can get past the login and read stored credentials.","severity":"high","cvss":6.5,"epss":null,"exploited":true,"exploited_at":"2025-09-03T00:00:00+00:00","products":[{"name":"TP-Link TL-WR841N","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr841n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr841n firmware","fixed":["11_211209"],"affected":">= 11_150616, < 11_211209","ecosystem":"vendor"},{"name":"tp-link tl-wr841n firmware","fixed":["12_230317"],"affected":">= 12_160624, < 12_230317","ecosystem":"vendor"},{"name":"tp-link mr6400 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wdr3600 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wdr4300 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wdr3500 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr710n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr740n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr741nd firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr743nd firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wr749n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link mr3420 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wr1043nd firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wr1045nd firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wr802n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr810n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr840n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wr841hp firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr841nd firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wr842n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wr842nd firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr843n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wr845n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wr945n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-mr3020 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-mr3220 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wa701nd firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link wa801nd firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link archer c5 firmware","fixed":["2_260429"],"affected":">= 2_150130, < 2_260429","ecosystem":"vendor"},{"name":"tp-link archer c7 firmware","fixed":["2_241108"],"affected":">= 2_131217, < 2_241108","ecosystem":"vendor"},{"name":"tp-link archer c7 firmware","fixed":[],"affected":"= 3_150508","ecosystem":"vendor"},{"name":"tp-link archer c1900 firmware","fixed":["1_260428"],"affected":"< 1_260428","ecosystem":"vendor"},{"name":"tp-link tl-wr902ac firmware","fixed":[],"affected":"= 1_160905","ecosystem":"vendor"},{"name":"tp-link tl-wr902ac firmware","fixed":[],"affected":"= 1_170628","ecosystem":"vendor"},{"name":"tp-link tl-wr940n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr940n firmware","fixed":[],"affected":">= 5_161019, <= 5_220801","ecosystem":"vendor"},{"name":"tp-link tl-wr940n firmware","fixed":["6_250925"],"affected":">= 6_170325, < 6_250925","ecosystem":"vendor"},{"name":"tp-link tl-wr940n plus firmware","fixed":[],"affected":"= 6_170704","ecosystem":"vendor"},{"name":"tp-link tl-wr940n plus firmware","fixed":[],"affected":"= 6_171115","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","routers","self-hosted","tl-wr841n","tp-link"],"not_affected_if":["not-tp-link-tl-wr841n","web-interface-not-reachable"],"how_to_check":"Identify any TL-WR841N units in use, including on the admin web interface at port 80. Check whether the vendor has issued firmware for the model; sources do not say.","fix":"Discontinue use of the device or replace it, since the product is end-of-life and the vendor has not provided a fix in the sources. Rotate any credentials stored on the router.","status":"open","published_at":"2024-05-03T03:16:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:25+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:46:25Z","model":"claude-haiku-5-5","output":{"fix":"Discontinue use of the device or replace it, since the product is end-of-life and the vendor has not provided a fix in the sources. Rotate any credentials stored on the router.","reach":"network","summary":"TP-Link TL-WR841N home routers have an authentication bypass in the httpd web service on TCP port 80, caused by spoofing. An attacker on the network can get past the login and read stored credentials.","category":"infrastructure","who_cares":["tp-link","tl-wr841n","self-hosted","routers"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker bypasses login and reads stored credentials from the router.","analyst_note":"Confirm the fixed firmware status for TL-WR841N and whether the spoofing bypass needs LAN access or is reachable from WAN; see the CISA KEV entry and vendor advisory.","how_to_check":"Identify any TL-WR841N units in use, including on the admin web interface at port 80. Check whether the vendor has issued firmware for the model; sources do not say.","needs_analyst":true,"not_affected_if":["not-tp-link-tl-wr841n","web-interface-not-reachable"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000479,"input_tokens":2603,"output_tokens":438,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':14A,17A '-50224':15A,18A '19899':407C '80':307B,380C 'adjac':342C 'affect':349C 'allow':339C 'archer':203A,209A,215A,221A 'attack':312B,343C,390C 'authent':9A,297B,333C,359C,388C 'bypass':298B 'c1900':222A 'c5':204A 'c7':210A,216A 'caus':308B 'compromis':402C 'credenti':324B,398C 'cve':13A,16A 'default':382C 'disclos':345C,396C 'disclosur':11A,335C 'dropbearpwd':7A,331C 'exist':370C 'exploit':275B,364C 'firmware':31A,38A,45A,50A,57A,64A,69A,76A,83A,90A,97A,102A,107A,112A,117A,122A,129A,136A,141A,148A,153A,158A,165A,170A,175A,182A,189A,194A,199A,205A,211A,217A,223A,230A,237A,244A,251A,258A,266A,274A 'flaw':369C 'get':317B 'home':293B 'host':280B 'httpd':301B,373C 'improp':8A,332C,387C 'inform':10A,334C,347C 'infrastructur':276B 'instal':350C 'issu':384C 'lead':399C 'leverag':392C 'link':3A,21A,27A,34A,41A,48A,53A,60A,67A,72A,79A,86A,93A,100A,105A,110A,115A,120A,125A,132A,139A,144A,151A,156A,161A,168A,173A,178A,185A,192A,197A,202A,208A,214A,220A,226A,233A,240A,247A,254A,261A,269A,286B,289B,327C,354C 'listen':376C 'login':320B 'mr3020':181A 'mr3220':188A 'mr3420':106A 'mr6400':49A 'network':315B,341C 'network-adjac':340C 'past':318B 'plus':265A,273A 'port':306B,379C 'read':322B 'requir':362C 'result':385C 'router':277B,294B,358C 'self':279B 'self-host':278B 'sensit':346C 'servic':303B,374C 'specif':368C 'spoof':310B 'store':323B,397C 'tcp':305B,378C 'tl':5A,23A,29A,36A,43A,55A,62A,74A,81A,88A,95A,127A,134A,146A,163A,180A,187A,228A,235A,242A,249A,256A,263A,271A,282B,291B,329C,356C 'tl-mr3020':179A 'tl-mr3220':186A 'tl-wdr3600':54A 'tl-wdr4300':61A 'tl-wr710n':73A 'tl-wr740n':80A 'tl-wr741nd':87A 'tl-wr743nd':94A 'tl-wr810n':126A 'tl-wr840n':133A 'tl-wr841n':4A,22A,28A,35A,42A,281B,290B,328C,355C 'tl-wr841nd':145A 'tl-wr843n':162A 'tl-wr902ac':227A,234A 'tl-wr940n':241A,248A,255A,262A,270A 'tp':2A,20A,26A,33A,40A,47A,52A,59A,66A,71A,78A,85A,92A,99A,104A,109A,114A,119A,124A,131A,138A,143A,150A,155A,160A,167A,172A,177A,184A,191A,196A,201A,207A,213A,219A,225A,232A,239A,246A,253A,260A,268A,285B,288B,326C,353C 'tp-link':1A,19A,25A,32A,39A,46A,51A,58A,65A,70A,77A,84A,91A,98A,103A,108A,113A,118A,123A,130A,137A,142A,149A,154A,159A,166A,171A,176A,183A,190A,195A,200A,206A,212A,218A,224A,231A,238A,245A,252A,259A,267A,284B,287B,325C,352C 'vulner':12A,336C,338C,366C,394C 'wa701nd':193A 'wa801nd':198A 'wdr3500':68A 'wdr3600':56A 'wdr4300':63A 'web':302B 'within':371C 'wr1043nd':111A 'wr1045nd':116A 'wr710n':75A 'wr740n':82A 'wr741nd':89A 'wr743nd':96A 'wr749n':101A 'wr802n':121A 'wr810n':128A 'wr840n':135A 'wr841hp':140A 'wr841n':6A,24A,30A,37A,44A,283B,292B,330C,357C 'wr841nd':147A 'wr842n':152A 'wr842nd':157A 'wr843n':164A 'wr845n':169A 'wr902ac':229A,236A 'wr940n':243A,250A,257A,264A,272A 'wr945n':174A 'zdi':405C 'zdi-can':404C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-05-03T03:16:10+00:00","kev":{"dateAdded":"2025-09-03","dueDate":"2025-09-24","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-50224","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-50224","severity":null,"published_at":"2025-09-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-50224","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50224","severity":null,"published_at":"2024-05-03T03:16:10+00:00","modified_at":"2026-09-03T17:28:42+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}