CVE-2023-50224
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
In short
A TP-Link TL-WR841N router has a flaw in its web interface (httpd) that allows anyone on the network to access and view stored login credentials without needing to authenticate first. This is dangerous because an attacker can use these credentials to fully control the router.
Technical detail
The httpd service on TCP port 80 implements improper authentication controls (CWE-290), allowing network-adjacent attackers to disclose stored credentials without authentication. The vulnerability requires network access but no prior authentication, and successful exploitation grants access to sensitive authentication information that can be leveraged for complete device compromise.
Summary generated and translated by AI from the official description.
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
. Was ZDI-CAN-19899.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
TP-Link · TL-WR841NWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →