CVE-2023-50224

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

MEDIUM

6.5

CVSS Score

Published: May 3, 2024 at 02:14 AM UTC

Updated: September 3, 2026 at 05:44 PM UTC

73 products affected across 1 vendorTL-WR841NTl WR940N FirmwareTl WR840N Firmware

Using TL-WR841N by TP-Link?

Get instant alerts when new vulnerabilities affect TL-WR841N - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploitation

CISA KEV

Exploit prediction

EPSS 20%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score20.0%

EPSS (Exploit Prediction Scoring System) estimates a 20.0% chance this CVE is exploited in the wild within the next 30 days — higher than 97% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

Sep 3, 2025

Remediation Due

Sep 24, 2025

397 days overdue

Notes

https://www.tp-link.com/us/support/faq/4308/

https://nvd.nist.gov/vuln/detail/CVE-2023-50224

Description

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. . Was ZDI-CAN-19899.