CVE-2023-50224

Summary

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

Affected Software

VendorProductVersion RangeStatus
TP-LinkTL-WR841N3.16.9 build 200409affected
TP-LinkTL-WR841NV8affected
TP-LinkTL-WR841NV9affected
TP-LinkTL-WR841NV10affected
TP-LinkTL-WR841NV11affected
TP-LinkTL-WR841NV11_211209unaffected
TP-LinkTL-WR841NV12affected
TP-LinkTL-WR841NV12_230317unaffected
TP-LinkTL-WR841NDV8affected
TP-LinkTL-WR841NDV9affected
TP-LinkTL-WR841NDV10affected
TP-LinkTL-WR841NDV11affected
TP-LinkTL-WR841NDV11_211209unaffected
TP-LinkTL-WR841NDV12affected
TP-LinkTL-WR841NDV12_230317unaffected
TP-LinkTL-MR6400V1affected
TP-LinkTL-MR6400V2affected
TP-LinkArcher C5V2affected
TP-LinkArcher C7V2affected
TP-LinkArcher C7V2_241108unaffected
TP-LinkArcher C7V3affected
TP-LinkTL-WDR3600V2affected
TP-LinkTL-WDR4300V1affected
TP-LinkTL-WDR3500V2affected
TP-LinkTL-WR740NV4affected
TP-LinkTL-WR740NV5affected
TP-LinkTL-WR740NV6affected
TP-LinkTL-WR740NV7affected
TP-LinkTL-WR741NDV4affected
TP-LinkTL-WR741NDV5affected
TP-LinkTL-WR741NDV6affected
TP-LinkTL-WR749NBR 6.0affected
TP-LinkTL-WR749NBR 7.0affected
TP-LinkTL-MR3420V2affected
TP-LinkTL-MR3420V3affected
TP-LinkTL-MR3420V4affected
TP-LinkTL-WR1043NDV2affected
TP-LinkTL-WR1043NDV3affected
TP-LinkTL-WR1043NDV4affected
TP-LinkTL-WR1045NDRU V2affected
TP-LinkTL-WR840NV2affected
TP-LinkTL-WR840NV3affected
TP-LinkTL-WR842NV2affected
TP-LinkTL-WR842NV3affected
TP-LinkTL-WR842NV4affected
TP-LinkTL-WR842NDV2affected
TP-LinkTL-WR842NDV3affected
TP-LinkTL-WR842NDV4affected
TP-LinkTL-WR845NV1affected
TP-LinkTL-WR845NV2affected
TP-LinkTL-WR941NDV5affected
TP-LinkTL-WR941NDV6affected
TP-LinkTL-WR941NDV6_220610unaffected
TP-LinkTL-WR945NV1affected
TP-LinkTL-WA801NDV3affected
TP-LinkTL-WA801NDV4affected
TP-LinkTL-WA901NDV3affected
TP-LinkTL-WA901NDV4affected
TP-LinkTL-WA901NDV4_201030unaffected
TP-LinkTL-WA901NDV5affected
TP-LinkTL-WA901NDV5_201030unaffected

Weaknesses

  • CWE-290: CWE-290: Authentication Bypass by Spoofing

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: active
    • Automatable: no
    • Technical Impact: partial

Additional References

CVE Program Container

Additional References

References