CVE-2023-50224
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
- Record
CVE-2023-50224- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-290
- Updated
- 2026-11-02
EUVDEUVD-2023-55046
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
- Record
EUVD-2023-55046- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g654-hw9f-49w6
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This...
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
- Record
GHSA-g654-hw9f-49w6- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-290
- Updated
- 2026-11-02
CISA KEV No score
TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Record
CVE-2023-50224- Weakness
- CWE-290
- Updated
- 2026-11-02
NVD
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
- Record
CVE-2023-50224- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-290
- Updated
- 2026-11-02
Affected products
- tp-link tl-wr841n
- tp-link archer c5
- tp-link archer c7
- tp-link archer c1900 firmware
- tp-link archer c5 firmware
- tp-link archer c7 firmware
- tp-link mr3420 firmware
- tp-link mr6400 firmware
- tp-link tl-mr3020 firmware
- tp-link tl-mr3220 firmware
- tp-link tl-mr3420
- tp-link tl-mr6400
Show 46 moreShow less
- tp-link tl-wa801nd
- tp-link tl-wa901nd
- tp-link tl-wdr3500
- tp-link tl-wdr3600
- tp-link tl-wdr3600 firmware
- tp-link tl-wdr4300
- tp-link tl-wdr4300 firmware
- tp-link tl-wr1043nd
- tp-link tl-wr1045nd
- tp-link tl-wr710n firmware
- tp-link tl-wr740n
- tp-link tl-wr740n firmware
- tp-link tl-wr741nd
- tp-link tl-wr741nd firmware
- tp-link tl-wr743nd firmware
- tp-link tl-wr749n
- tp-link tl-wr810n firmware
- tp-link tl-wr840n
- tp-link tl-wr840n firmware
- tp-link tl-wr841n firmware
- tp-link tl-wr841nd
- tp-link tl-wr841nd firmware
- tp-link tl-wr842n
- tp-link tl-wr842nd
- tp-link tl-wr843n firmware
- tp-link tl-wr845n
- tp-link tl-wr902ac firmware
- tp-link tl-wr940n firmware
- tp-link tl-wr940n plus firmware
- tp-link tl-wr941nd
- tp-link tl-wr941nd firmware
- tp-link tl-wr945n
- tp-link wa701nd firmware
- tp-link wa801nd firmware
- tp-link wa901nd firmware
- tp-link wdr3500 firmware
- tp-link wr1043nd firmware
- tp-link wr1045nd firmware
- tp-link wr749n firmware
- tp-link wr802n firmware
- tp-link wr841hp firmware
- tp-link wr842n firmware
- tp-link wr842nd firmware
- tp-link wr845n firmware
- tp-link wr941hp firmware
- tp-link wr945n firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-50224 is a medium vulnerability (CVSS 6.5) in Tp-link Tl-wr841n, published May 3, 2024. CISA lists it as known to be exploited, since September 3, 2025. EUVD reports exploitation since September 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 20.0%, the 97th percentile. No source names a fixed version.