TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

CVE-2023-50224

What is CVE-2023-50224?

CVE-2023-50224 is a vulnerability found in the TP-Link TL-WR841N router model, related to its dropbearpwd service. This vulnerability stems from improper authentication processes, which could allow network-adjacent attackers to access sensitive information without requiring any authentication. Given that the affected service listens on the default TCP port 80, the risk of exposure is heightened for devices connected to the same network. The potential threat includes the unauthorized disclosure of stored credentials, enabling attackers to take further actions against the router or the broader network it supports.

Potential impact of CVE-2023-50224

1. Information Disclosure: The primary concern is the potential for attackers to obtain sensitive authentication information, which can lead to further exploits on the local network or compromise associated devices.

2. Increased Attack Surface: Once attackers gain access to stored credentials, they could potentially escalate their privileges, allowing them to manipulate network settings or configure the router for malicious purposes, such as intercepting user traffic.

3. Network Compromise: With the ability to disclose sensitive information, the vulnerability poses a risk of broader network attacks, where adversaries could exploit the compromised router to access other devices and sensitive data within the network, leading to significant data breaches.

News Articles

BleepingComputer

CVE-2023-50224CVE-2025-9377

New TP-Link zero-day surfaces as CISA warns other flaws are exploited

TP-Link has confirmed the existence of an unpatched zero-day vulnerability impacting multiple router models, as CISA warns that other router flaws have been exploited in attacks.

3 weeks ago

References