CVE-2023-50224: medium-severity vulnerability in TP-Link TL-WR841N
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A TP-Link TL-WR841N router has a flaw in its web interface (httpd) that allows anyone on the network to access and view stored login credentials without needing to authenticate first. This is dangerous because an attacker can use these credentials to fully control the router.
The httpd service on TCP port 80 implements improper authentication controls (CWE-290), allowing network-adjacent attackers to disclose stored credentials without authentication. The vulnerability requires network access but no prior authentication, and successful exploitation grants access to sensitive authentication information that can be leveraged for complete device compromise.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.