CVE-2023-50224
TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
Description
CVE-2023-50224 is a medium-severity improper authentication vulnerability in the TP-Link TL-WR841N router that allows network-adjacent attackers to disclose sensitive information, including stored credentials, without authentication. The flaw exists in the httpd service running on TCP port 80, where improper authentication allows unauthenticated access to credential data. With a CVSS v3.0 base score of 6.5, the vulnerability requires only adjacent network access and no authentication, making it exploitable by any attacker on the same network segment. CISA has added CVE-2023-50224 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 24, 2025, and its EPSS score of 1.50% at the 81st percentile indicates meaningful exploitation probability for this consumer router vulnerability.
KEV Information
CVSS Score
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| tp-link | tl-wr841n firmware | 3.16.9 |
References
- https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware(Product)
- https://www.zerodayinitiative.com/advisories/ZDI-23-1808/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-50224(US Government Resource)
Weakness Type
CWE-290: Authentication Bypass by Spoofing
CVE-2023-50224 is classified under CWE-290 (Authentication Bypass by Spoofing), a weakness where an authentication mechanism can be bypassed through spoofing or otherwise circumventing the identity verification process. In the TP-Link TL-WR841N router's httpd service, the authentication mechanism improperly validates requests, allowing an unauthenticated network-adjacent attacker to access the dropbearpwd interface and retrieve stored credentials without providing valid credentials.
Learn more: CWE-290 — Authentication Bypass by Spoofing
Impact Analysis
CVE-2023-50224 carries a CVSS v3.0 base score of 6.5 (Medium severity), exploitable from an adjacent network (AV:A) with low attack complexity (AC:L), no authentication (PR:N), and no user interaction (UI:N). Confidentiality faces high impact because the vulnerability directly exposes stored credentials from the router, including administrative passwords and potentially Wi-Fi pre-shared keys. An attacker who obtains these credentials can gain full administrative access to the router, enabling them to modify DNS settings, redirect traffic, install malicious firmware, or use the compromised router as a pivot point for further network attacks. The adjacent network attack vector means the attacker must be on the same local network segment — either connected to the same Wi-Fi network, on the same LAN, or within wireless range if the network is open or its key has been compromised. While this limits remote exploitation, many scenarios exist where adjacent access is available: shared office networks, public Wi-Fi environments, or neighboring networks within wireless range. The TL-WR841N is one of the most popular consumer routers worldwide, making the total number of vulnerable devices significant.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-50224 by adding it to the Known Exploited Vulnerabilities catalog, indicating that threat actors are targeting TP-Link TL-WR841N routers. The EPSS score of 1.50% at the 81st percentile places this vulnerability above average in exploitation probability. The vulnerability was originally reported through the Zero Day Initiative as ZDI-CAN-19899, which provides a third-party advisory with technical details. No tagged public exploit code is available in the references, but the low complexity of the attack — simply accessing the httpd service on the local network without authentication — means exploitation requires minimal technical sophistication. The ransomware association is currently classified as unknown. Consumer routers are frequent targets for botnet operators and threat actors seeking to establish persistent network access, and the credential disclosure capability of this vulnerability provides a straightforward path to full router compromise.
Remediation
-
Update the TL-WR841N firmware to the latest available version. TP-Link provides firmware downloads at their support page for the TL-WR841N. Verify the hardware version of your device and download the corresponding firmware update.
-
Change all router credentials after applying the firmware update. The vulnerability may have already exposed administrative passwords and other stored credentials. Set a strong, unique password for the router administration interface and update the Wi-Fi pre-shared key.
-
Disable remote management and restrict administrative access to the router interface. Ensure the web administration interface (TCP port 80) is not accessible from the WAN side. If possible, restrict LAN-side access to specific IP addresses.
-
Monitor for unauthorized devices on the network. Check the router's connected device list for unfamiliar entries that might indicate an attacker has used disclosed credentials to connect. Review DHCP leases and wireless client lists for suspicious activity.
-
Consider replacing end-of-life hardware if TP-Link no longer provides firmware updates for your specific TL-WR841N hardware version. Consumer routers that no longer receive security updates represent an ongoing risk, and upgrading to a supported model with active security maintenance is the most effective long-term remediation.
Technical Details
CVE-2023-50224 is an improper authentication vulnerability (CWE-290) in the TP-Link TL-WR841N router's httpd service. The CVSS v3.0 vector CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates an adjacent-network attack with low complexity, no authentication requirement, and high confidentiality impact. The vulnerability exists in the web server (httpd) that listens on TCP port 80 on the TL-WR841N. The httpd service exposes the dropbearpwd interface, which contains stored authentication credentials. Due to an improper authentication implementation, the service fails to properly verify that incoming requests to access the dropbearpwd resource are from authenticated users. A network-adjacent attacker can send HTTP requests directly to the vulnerable endpoint without providing valid credentials and receive the stored password data in the response. The disclosed credentials can include the router's administrative password, which grants full control over the device configuration. The firmware version 3.16.9 on the TL-WR841N v12 hardware revision is confirmed affected. The vulnerability was discovered and reported through the Zero Day Initiative program as ZDI-CAN-19899.
Frequently Asked Questions
Is CVE-2023-50224 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2023-50224 to the KEV catalog. The EPSS score of 1.50% at the 81st percentile indicates above-average exploitation probability. The low complexity of the attack makes it accessible to a wide range of threat actors.
What products are affected by CVE-2023-50224?
The TP-Link TL-WR841N router is affected, specifically firmware version 3.16.9. The TL-WR841N is one of the most widely deployed consumer routers globally. Check your specific hardware version for firmware update availability.
How do I fix CVE-2023-50224?
Update the TL-WR841N firmware to the latest version available from TP-Link's support page. After updating, change all router credentials including the administrative password and Wi-Fi pre-shared key, as these may have been exposed.
How severe is CVE-2023-50224?
CVE-2023-50224 has a CVSS v3.0 base score of 6.5 (Medium). While the direct impact is information disclosure of stored credentials, the disclosed credentials enable full administrative access to the router, making the practical impact significantly higher than the base score suggests.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.