CVE-2023-50224

EUVD-2023-55046
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 97.41%
Affected Products (NVD)
VendorProductVersion
tp-linktl-wr841n_firmware
-
tp-linktl-wr841n_firmware
11_150616 ≤
𝑥
< 11_211209
tp-linktl-wr841n_firmware
12_160624 ≤
𝑥
< 12_230317
tp-linkmr6400_firmware
-
tp-linktl-wdr3600_firmware
-
tp-linktl-wdr4300_firmware
-
tp-linkwdr3500_firmware
-
tp-linktl-wr710n_firmware
-
tp-linktl-wr740n_firmware
-
tp-linktl-wr741nd_firmware
-
tp-linktl-wr743nd_firmware
-
tp-linkwr749n_firmware
-
tp-linkmr3420_firmware
-
tp-linkwr1043nd_firmware
-
tp-linkwr1045nd_firmware
-
tp-linkwr802n_firmware
-
tp-linktl-wr810n_firmware
-
tp-linktl-wr840n_firmware
-
tp-linkwr841hp_firmware
-
tp-linktl-wr841nd_firmware
-
tp-linkwr842n_firmware
-
tp-linkwr842nd_firmware
-
tp-linktl-wr843n_firmware
-
tp-linkwr845n_firmware
-
tp-linkwr945n_firmware
-
tp-linktl-mr3020_firmware
-
tp-linktl-mr3220_firmware
-
tp-linkmr3420_firmware
-
tp-linkwa701nd_firmware
-
tp-linkwa801nd_firmware
-
tp-linkarcher_c5_firmware
2_150130 ≤
𝑥
< 2_260429
tp-linkarcher_c7_firmware
2_131217 ≤
𝑥
< 2_241108
tp-linkarcher_c1900_firmware
𝑥
< 1_260428
tp-linktl-wr940n_firmware
-
tp-linktl-wr940n_firmware
5_161019 ≤
𝑥
≤ 5_220801
tp-linktl-wr940n_firmware
6_170325 ≤
𝑥
< 6_250925
tp-linkwr941hp_firmware
𝑥
< 1_211210
tp-linktl-wr941nd_firmware
-
tp-linktl-wr941nd_firmware
6_150206 ≤
𝑥
< 6_220610
tp-linkwa901nd_firmware
-
tp-linkwa901nd_firmware
6_191127 ≤
𝑥
< 6_220701
tp-linkwa901nd_firmware
4_151029 ≤
𝑥
< 4_201030
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
tp-linktl-wr841n_firmware
𝑥
< 12.0
ADP
Common Weakness Enumeration
References
https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware
https://www.tp-link.com/us/support/faq/5058/
https://www.zerodayinitiative.com/advisories/ZDI-23-1808/
https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware
https://www.zerodayinitiative.com/advisories/ZDI-23-1808/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-50224