--- id: "CVE-2023-50224" kind: "vulnerability" aliases: ["CVE-2023-50224"] title: "TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability" severity: "high" cvss: 6.5 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "TP-Link TL-WR841N", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr841n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr841n firmware", "fixed": ["11_211209"], "affected": ">= 11_150616, < 11_211209", "ecosystem": "vendor"}, {"name": "tp-link tl-wr841n firmware", "fixed": ["12_230317"], "affected": ">= 12_160624, < 12_230317", "ecosystem": "vendor"}, {"name": "tp-link mr6400 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wdr3600 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wdr4300 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wdr3500 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr710n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr740n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr741nd firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr743nd firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wr749n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link mr3420 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wr1043nd firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wr1045nd firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wr802n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr810n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr840n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wr841hp firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr841nd firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wr842n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wr842nd firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr843n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wr845n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wr945n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-mr3020 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-mr3220 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wa701nd firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link wa801nd firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link archer c5 firmware", "fixed": ["2_260429"], "affected": ">= 2_150130, < 2_260429", "ecosystem": "vendor"}, {"name": "tp-link archer c7 firmware", "fixed": ["2_241108"], "affected": ">= 2_131217, < 2_241108", "ecosystem": "vendor"}, {"name": "tp-link archer c7 firmware", "fixed": [], "affected": "= 3_150508", "ecosystem": "vendor"}, {"name": "tp-link archer c1900 firmware", "fixed": ["1_260428"], "affected": "< 1_260428", "ecosystem": "vendor"}, {"name": "tp-link tl-wr902ac firmware", "fixed": [], "affected": "= 1_160905", "ecosystem": "vendor"}, {"name": "tp-link tl-wr902ac firmware", "fixed": [], "affected": "= 1_170628", "ecosystem": "vendor"}, {"name": "tp-link tl-wr940n firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr940n firmware", "fixed": [], "affected": ">= 5_161019, <= 5_220801", "ecosystem": "vendor"}, {"name": "tp-link tl-wr940n firmware", "fixed": ["6_250925"], "affected": ">= 6_170325, < 6_250925", "ecosystem": "vendor"}, {"name": "tp-link tl-wr940n plus firmware", "fixed": [], "affected": "= 6_170704", "ecosystem": "vendor"}, {"name": "tp-link tl-wr940n plus firmware", "fixed": [], "affected": "= 6_171115", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "infrastructure", "routers", "self-hosted", "tl-wr841n", "tp-link"] not_affected_if: ["not-tp-link-tl-wr841n", "web-interface-not-reachable"] published_at: "2024-05-03T03:16:10+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T22:29:05+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-50224", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50224", "first_seen_at": "2026-10-23T22:29:05+00:00"}] --- # TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability TP-Link TL-WR841N home routers have an authentication bypass in the httpd web service on TCP port 80, caused by spoofing. An attacker on the network can get past the login and read stored credentials. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:TP-Link TL-WR841N affected ? fixed ? - vendor:tp-link tl-wr841n firmware affected ? fixed ? - vendor:tp-link tl-wr841n firmware affected >= 11_150616, < 11_211209 fixed 11_211209 - vendor:tp-link tl-wr841n firmware affected >= 12_160624, < 12_230317 fixed 12_230317 - vendor:tp-link mr6400 firmware affected ? fixed ? - vendor:tp-link tl-wdr3600 firmware affected ? fixed ? - vendor:tp-link tl-wdr4300 firmware affected ? fixed ? - vendor:tp-link wdr3500 firmware affected ? fixed ? - vendor:tp-link tl-wr710n firmware affected ? fixed ? - vendor:tp-link tl-wr740n firmware affected ? fixed ? - vendor:tp-link tl-wr741nd firmware affected ? fixed ? - vendor:tp-link tl-wr743nd firmware affected ? fixed ? - vendor:tp-link wr749n firmware affected ? fixed ? - vendor:tp-link mr3420 firmware affected ? fixed ? - vendor:tp-link wr1043nd firmware affected ? fixed ? - vendor:tp-link wr1045nd firmware affected ? fixed ? - vendor:tp-link wr802n firmware affected ? fixed ? - vendor:tp-link tl-wr810n firmware affected ? fixed ? - vendor:tp-link tl-wr840n firmware affected ? fixed ? - vendor:tp-link wr841hp firmware affected ? fixed ? - vendor:tp-link tl-wr841nd firmware affected ? fixed ? - vendor:tp-link wr842n firmware affected ? fixed ? - vendor:tp-link wr842nd firmware affected ? fixed ? - vendor:tp-link tl-wr843n firmware affected ? fixed ? - vendor:tp-link wr845n firmware affected ? fixed ? - vendor:tp-link wr945n firmware affected ? fixed ? - vendor:tp-link tl-mr3020 firmware affected ? fixed ? - vendor:tp-link tl-mr3220 firmware affected ? fixed ? - vendor:tp-link wa701nd firmware affected ? fixed ? - vendor:tp-link wa801nd firmware affected ? fixed ? - vendor:tp-link archer c5 firmware affected >= 2_150130, < 2_260429 fixed 2_260429 - vendor:tp-link archer c7 firmware affected >= 2_131217, < 2_241108 fixed 2_241108 - vendor:tp-link archer c7 firmware affected = 3_150508 fixed ? - vendor:tp-link archer c1900 firmware affected < 1_260428 fixed 1_260428 - vendor:tp-link tl-wr902ac firmware affected = 1_160905 fixed ? - vendor:tp-link tl-wr902ac firmware affected = 1_170628 fixed ? - vendor:tp-link tl-wr940n firmware affected ? fixed ? - vendor:tp-link tl-wr940n firmware affected >= 5_161019, <= 5_220801 fixed ? - vendor:tp-link tl-wr940n firmware affected >= 6_170325, < 6_250925 fixed 6_250925 - vendor:tp-link tl-wr940n plus firmware affected = 6_170704 fixed ? - vendor:tp-link tl-wr940n plus firmware affected = 6_171115 fixed ? ## How to check Identify any TL-WR841N units in use, including on the admin web interface at port 80. Check whether the vendor has issued firmware for the model; sources do not say. ## Fix Discontinue use of the device or replace it, since the product is end-of-life and the vendor has not provided a fix in the sources. Rotate any credentials stored on the router. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-50224 - 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-50224 ## From the sources TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_