CVE-2023-50224: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2025-09-03. EPSS: 17% chance of exploitation in the next 30 days.

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

Affected products

  • TP-Link Archer c1900 Firmware: before 1_260428 (fixed in 1_260428)
  • TP-Link Archer c5 Firmware: from 2_150130, before 2_260429 (fixed in 2_260429)
  • TP-Link Archer c7 Firmware: from 2_131217, before 2_241108 (fixed in 2_241108); version 3_150508 only
  • TP-Link MR3420 Firmware: affected versions not specified
  • TP-Link MR6400 Firmware: affected versions not specified
  • TP-Link Tl-MR3020 Firmware: affected versions not specified
  • TP-Link Tl-MR3220 Firmware: affected versions not specified
  • TP-Link Tl-WDR3600 Firmware: affected versions not specified
  • TP-Link Tl-WDR4300 Firmware: affected versions not specified
  • TP-Link Tl-WR710N Firmware: affected versions not specified
  • TP-Link Tl-WR740N Firmware: affected versions not specified
  • TP-Link Tl-WR741ND Firmware: affected versions not specified
  • TP-Link Tl-WR743ND Firmware: affected versions not specified
  • TP-Link Tl-WR810N Firmware: affected versions not specified
  • TP-Link Tl-WR840N Firmware: affected versions not specified
  • TP-Link TL-WR841N Firmware: affected versions not specified; from 11_150616, before 11_211209 (fixed in 11_211209); from 12_160624, before 12_230317 (fixed in 12_230317)
  • TP-Link Tl-WR841ND Firmware: affected versions not specified
  • TP-Link Tl-WR843N Firmware: affected versions not specified
  • TP-Link Tl-WR902AC Firmware: version 1_160905 only; version 1_170628 only
  • TP-Link Tl-WR940N Firmware: affected versions not specified; from 5_161019, up to and including 5_220801; from 6_170325, before 6_250925 (fixed in 6_250925)
  • TP-Link Tl-WR940N Plus Firmware: version 6_170704 only; version 6_171115 only
  • TP-Link Tl-WR941ND Firmware: affected versions not specified; from 6_150206, before 6_220610 (fixed in 6_220610)
  • TP-Link WA701ND Firmware: affected versions not specified
  • TP-Link WA801ND Firmware: affected versions not specified
  • TP-Link WA901ND Firmware: affected versions not specified; version 5_160929 only; from 6_191127, before 6_220701 (fixed in 6_220701); from 4_151029, before 4_201030 (fixed in 4_201030)
  • and 11 more

Published 2024-05-03. Last modified 2026-09-03.