CVE-2023-50224

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

State: Published
Severity: 6.5 Medium
Published: May 3, 2024
Updated: Sep 2, 2026
Reserved: Dec 5, 2023

Description

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	zdi

Weaknesses

CWE-290 Authentication Bypass by Spoofing

Affected Products

Product	Versions
TL-WR841NTP-Link	3.16.9 build 200409Affected V8Affected V9Affected V10Affected V11Affected V11_211209Not affected V12Affected V12_230317Not affected
TL-WR841NDTP-Link	V8Affected V9Affected V10Affected V11Affected V11_211209Not affected V12Affected V12_230317Not affected
TL-MR6400TP-Link	V1Affected V2Affected
Archer C5TP-Link	V2Affected
Archer C7TP-Link	V2Affected V2_241108Not affected V3Affected
TL-WDR3600TP-Link	V2Affected
TL-WDR4300TP-Link	V1Affected
TL-WDR3500TP-Link	V2Affected
TL-WR740NTP-Link	V4Affected V5Affected V6Affected V7Affected
TL-WR741NDTP-Link	V4Affected V5Affected V6Affected
TL-WR749NTP-Link	BR 6.0Affected BR 7.0Affected
TL-MR3420TP-Link	V2Affected V3Affected V4Affected
TL-WR1043NDTP-Link	V2Affected V3Affected V4Affected
TL-WR1045NDTP-Link	RU V2Affected
TL-WR840NTP-Link	V2Affected V3Affected
TL-WR842NTP-Link	V2Affected V3Affected V4Affected
TL-WR842NDTP-Link	V2Affected V3Affected V4Affected
TL-WR845NTP-Link	V1Affected V2Affected
TL-WR941NDTP-Link	V5Affected V6Affected V6_220610Not affected
TL-WR945NTP-Link	V1Affected
TL-WA801NDTP-Link	V3Affected V4Affected
TL-WA901NDTP-Link	V3Affected V4Affected V4_201030Not affected V5Affected V5_201030Not affected

References

ZDI-23-1808
vendor-provided URLvendor-advisory
vendor-advisoryvendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-50224government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.