# CVE-2023-50224

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

- Page: https://www.vulneraibility.com/cve/CVE-2023-50224
- CVSS: 6.5
- Known exploited: yes, in CISA KEV since 2025-09-03; CISA due date 2025-09-24
- EPSS: 20.02%
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-09-03)
- Weakness: CWE-290
- Published: 2024-05-03

## Affected versions

- TP-Link Archer C5: affected V2
- TP-Link Archer C7: affected V2; V3; fixed in V2_241108
- TP-Link TL-MR3420: affected V2; V3; V4
- TP-Link TL-MR6400: affected V1; V2
- TP-Link TL-WA801ND: affected V3; V4
- TP-Link TL-WA901ND: affected V3; V4; V5; fixed in V4_201030, V5_201030
- TP-Link TL-WDR3500: affected V2
- TP-Link TL-WDR3600: affected V2
- TP-Link TL-WDR4300: affected V1
- TP-Link TL-WR1043ND: affected V2; V3; V4
- TP-Link TL-WR1045ND: affected RU V2
- TP-Link TL-WR740N: affected V4; V5; V6; V7
- TP-Link TL-WR741ND: affected V4; V5; V6
- TP-Link TL-WR749N: affected BR 6.0; BR 7.0
- TP-Link TL-WR840N: affected V2; V3
- TP-Link TL-WR841N: affected 3.16.9 build 200409; V8; V9; V10; V11; V12; fixed in V11_211209, V12_230317
- TP-Link TL-WR841ND: affected V8; V9; V10; V11; V12; fixed in V11_211209, V12_230317
- TP-Link TL-WR842N: affected V2; V3; V4
- TP-Link TL-WR842ND: affected V2; V3; V4
- TP-Link TL-WR845N: affected V1; V2
- TP-Link TL-WR941ND: affected V5; V6; fixed in V6_220610
- TP-Link TL-WR945N: affected V1

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://www.zerodayinitiative.com/advisories/ZDI-23-1808/
- [advisory] https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware
- [advisory] https://www.tp-link.com/us/support/faq/5058/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-50224

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.