TP-Link Tl-WDR4300 Firmware vulnerabilities

7 CVEs affecting TP-Link Tl-WDR4300 Firmware, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-50224, published 2024-05-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-3035: TP-Link Multiple Archer Devices Directory Traversal Vulnerability, published 2015-04-22. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 83.9% chance of exploitation in the next 30 days. Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500…
CVE-2023-50224: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability, published 2024-05-03. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2025-09-03. EPSS: 20% chance of exploitation in the next 30 days. TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected…
CVE-2019-6487, published 2019-01-18. High severity, CVSS 8.8. EPSS: 8.5% chance of exploitation in the next 30 days. TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included…
CVE-2013-4654, published 2019-11-13. Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days. Symlink Traversal vulnerability in TP-LINK TL-WDR4300 and TL-1043ND..
CVE-2014-4727, published 2014-09-30. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to inject…
CVE-2014-4728, published 2014-09-30. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to cause a denial of service (crash) via a long header in a GET…
CVE-2013-4848, published 2019-10-25. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities.