CyberSecBulletin
CVE-2023-50224Exploited in the wildNVD status: Analyzed

TP-Link TL-WR841N Authentication Bypass by Spoofing

Published Updated By the CyberSecBulletin desk

CVE-2023-50224 is a medium-severity authentication bypass by spoofing vulnerability in TL-WR841N from TP-Link, with a CVSS 3.1 base score of 6.5 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. Affected TL-WR841N versions: 3.16.9 build 200409; V8; V9, and others listed below. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on September 3, 2025, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update tl-wr841n_firmware to 12.0 or a later version.
  2. Update Archer C5 Firmware to 2_260429 or a later version.
  3. Update Archer C7 Firmware to 2_241108 or a later version.
  4. CISA's required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
  5. Read the advisory on tp-link.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
TP-LinkTL-WR841N3.16.9 build 200409; V8; V9; V10; V11; V12Not stated
TP-LinkTL-WR841NDV8; V9; V10; V11; V12Not stated
TP-LinkTL-MR6400V1; V2Not stated
TP-LinkArcher C5V2Not stated
TP-LinkArcher C7V2; V3Not stated
TP-LinkTL-WDR3600V2Not stated
TP-LinkTL-WDR4300V1Not stated
TP-LinkTL-WDR3500V2Not stated
TP-LinkTL-WR740NV4; V5; V6; V7Not stated
TP-LinkTL-WR741NDV4; V5; V6Not stated
TP-LinkTL-WR749NBR 6.0; BR 7.0Not stated
TP-LinkTL-MR3420V2; V3; V4Not stated
TP-LinkTL-WR1043NDV2; V3; V4Not stated
TP-LinkTL-WR1045NDRU V2Not stated
TP-LinkTL-WR840NV2; V3Not stated
TP-LinkTL-WR842NV2; V3; V4Not stated
TP-LinkTL-WR842NDV2; V3; V4Not stated
TP-LinkTL-WR845NV1; V2Not stated
TP-LinkTL-WR941NDV5; V6Not stated
TP-LinkTL-WR945NV1Not stated
TP-LinkTL-WA801NDV3; V4Not stated
TP-LinkTL-WA901NDV3; V4; V5Not stated
TP-Linktl-wr841n_firmwarebefore 12.012.0
TP-LinkMr6400 FirmwareNot specified in the recordNot stated
TP-LinkTl-wdr3600 FirmwareNot specified in the recordNot stated

Version data comes from the organisation that assigned the CVE; 33 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Scored by CNA (trendmicro.com).

Official description

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

More Authentication Bypass by Spoofing vulnerabilities (CWE-290)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: partial).
  3. Added to CISA's Known Exploited Vulnerabilities catalogue.
  4. Deadline for US federal agencies to remediate, set by CISA.
  5. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Other vulnerabilities in TL-WR841N

All TL-WR841N vulnerabilities

Recent Authentication Bypass by Spoofing vulnerabilities

Spotted an error? Tell us.