CVE-2023-50224KEV · OVERDUECWE-290

TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

Medium · published May 3, 2024

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 97.4th percentile for exploit probability.

395
days past CISA
deadline
CVSS v3.1
6.5
EPSS
20%
Percentile
97.4
In the wild
Confirmed
What it is

⚠️ A misstep in authentication means anyone with network access can peek behind the curtain! This vulnerability in TP-Link TL-WR841N routers exposes sensitive information, and it doesn’t even require a password to exploit! 🔍 Think of this vulnerability like a restaurant where the kitchen staff forgot to lock the door—anyone passing by can just waltz in and read the recipes! When sensitive data is stored without proper protection, it's like serving the secret sauce recipe on the menu for all to see. In this case, an attacker can easily grab sensitive credentials stored on the router, which could lead to a cascade of further compromises. Imagine the chaos if your private network settings or personal information were exposed—it's a recipe for disaster!

Put simply

Think of this vulnerability like a restaurant where the kitchen staff forgot to lock the door—anyone passing by can just waltz in and read the recipes! When sensitive data is stored without proper protection, it's like serving the secret sauce recipe on the menu for all to see. This vulnerability exists in the httpd service on the TP-Link TL-WR841N, allowing unauthenticated attackers to access sensitive information due to improper authentication controls. Essentially, the router is too trusting and gives away secrets without verifying who’s asking.

What to do

In this case, an attacker can easily grab sensitive credentials stored on the router, which could lead to a cascade of further compromises. Imagine the chaos if your private network settings or personal information were exposed—it's a recipe for disaster! To mitigate this vulnerability, update your TP-Link router to the latest firmware version immediately. Additionally, consider changing default settings and ensuring your network is protected with strong passwords. Regularly auditing connected devices is also a good practice to safeguard against potential breaches. You've got this! With a few simple updates and precautions, you'll have your network locked down tight! 🛡️

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.20021 · 97.4th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2024-05-03T07:16Z
KEV added
2025-09-03 · due 2025-09-24
Affected products (48)
ProductVersionsFixed in
tp-link/tl-wr841n_firmwareall versions—
tp-link/tl-wr841n_firmware≥ 11_150616, < 11_21120911_211209
tp-link/tl-wr841n_firmware≥ 12_160624, < 12_23031712_230317
tp-link/mr6400_firmwareall versions—
tp-link/tl-wdr3600_firmwareall versions—
tp-link/tl-wdr4300_firmwareall versions—
tp-link/wdr3500_firmwareall versions—
tp-link/tl-wr710n_firmwareall versions—
tp-link/tl-wr740n_firmwareall versions—
tp-link/tl-wr741nd_firmwareall versions—
tp-link/tl-wr743nd_firmwareall versions—
tp-link/wr749n_firmwareall versions—
tp-link/mr3420_firmwareall versions—
tp-link/wr1043nd_firmwareall versions—
tp-link/wr1045nd_firmwareall versions—
tp-link/wr802n_firmwareall versions—
tp-link/tl-wr810n_firmwareall versions—
tp-link/tl-wr840n_firmwareall versions—
tp-link/wr841hp_firmwareall versions—
tp-link/tl-wr841nd_firmwareall versions—
tp-link/wr842n_firmwareall versions—
tp-link/wr842nd_firmwareall versions—
tp-link/tl-wr843n_firmwareall versions—
tp-link/wr845n_firmwareall versions—
tp-link/wr945n_firmwareall versions—
tp-link/tl-mr3020_firmwareall versions—
tp-link/tl-mr3220_firmwareall versions—
tp-link/mr3420_firmwareall versions—
tp-link/wa701nd_firmwareall versions—
tp-link/wa801nd_firmwareall versions—
tp-link/archer_c5_firmware≥ 2_150130, < 2_2604292_260429
tp-link/archer_c7_firmware≥ 2_131217, < 2_2411082_241108
tp-link/archer_c7_firmwareall versions—
tp-link/archer_c1900_firmware< 1_2604281_260428
tp-link/tl-wr902ac_firmwareall versions—
tp-link/tl-wr902ac_firmwareall versions—
tp-link/tl-wr940n_firmwareall versions—
tp-link/tl-wr940n_firmware≥ 5_161019, ≤ 5_220801—
tp-link/tl-wr940n_firmware≥ 6_170325, < 6_2509256_250925
tp-link/tl-wr940n_plus_firmwareall versions—
tp-link/tl-wr940n_plus_firmwareall versions—
tp-link/wr941hp_firmware< 1_2112101_211210
tp-link/tl-wr941nd_firmwareall versions—
tp-link/tl-wr941nd_firmware≥ 6_150206, < 6_2206106_220610
tp-link/wa901nd_firmwareall versions—
tp-link/wa901nd_firmwareall versions—
tp-link/wa901nd_firmware≥ 6_191127, < 6_2207016_220701
tp-link/wa901nd_firmware≥ 4_151029, < 4_2010304_201030
References (6)
EPSS history
Timeline
  • 03 SEP 00:00Z
    Added to CISA KEV — remediate by Sep 24
    kev
  • 03 MAY 02:14Z
    TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
    cvelistv5