VulnTideExploited vulnerabilities, by vendor. Data as of 28 Oct 2026.
Known exploitedIn CISA's KEV catalog since 3 September 2025Ransomware use: unknown
TP-Link TL-WR841N

CVE-2023-50224: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 3 Sep 2025, 488 days after the CVE record was published.

How likely is exploitation in the next 30 days?
20%

EPSS score, percentile 97.4 of all scored records

How severe?
6.5 Medium

CVSS v3.1 base score, given by the CNA

What should I do?

CISA deadline 24 Sep 2025. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Advisories and patches (2)

Which versions are affected?

Affected

  • 3.16.9 build 200409
  • V8
  • V9
  • V10
  • V11
  • V12

and 42 more in the table below

Unaffected V11_211209; V12_230317; V11_211209; V12_230317; V2_241108; V6_220610

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

Required action, set by CISA

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date for this action: 24 September 2025.

Advisories and patches

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

TP-Link TL-WR841N
StatusVersions
Affected3.16.9 build 200409
AffectedV8
AffectedV9
AffectedV10
AffectedV11
UnaffectedV11_211209
AffectedV12
UnaffectedV12_230317

Versions not listed are: affected.

TP-Link TL-WR841ND
StatusVersions
AffectedV8
AffectedV9
AffectedV10
AffectedV11
UnaffectedV11_211209
AffectedV12
UnaffectedV12_230317

Versions not listed are: affected.

TP-Link TL-MR6400
StatusVersions
AffectedV1
AffectedV2

Versions not listed are: affected.

TP-Link Archer C5
StatusVersions
AffectedV2

Versions not listed are: affected.

TP-Link Archer C7
StatusVersions
AffectedV2
UnaffectedV2_241108
AffectedV3

Versions not listed are: affected.

TP-Link TL-WDR3600
StatusVersions
AffectedV2

Versions not listed are: affected.

TP-Link TL-WDR4300
StatusVersions
AffectedV1

Versions not listed are: affected.

TP-Link TL-WDR3500
StatusVersions
AffectedV2

Versions not listed are: affected.

TP-Link TL-WR740N
StatusVersions
AffectedV4
AffectedV5
AffectedV6
AffectedV7

Versions not listed are: affected.

TP-Link TL-WR741ND
StatusVersions
AffectedV4
AffectedV5
AffectedV6

Versions not listed are: affected.

TP-Link TL-WR749N
StatusVersions
AffectedBR 6.0
AffectedBR 7.0

Versions not listed are: affected.

TP-Link TL-MR3420
StatusVersions
AffectedV2
AffectedV3
AffectedV4

Versions not listed are: affected.

TP-Link TL-WR1043ND
StatusVersions
AffectedV2
AffectedV3
AffectedV4

Versions not listed are: affected.

TP-Link TL-WR1045ND
StatusVersions
AffectedRU V2

Versions not listed are: affected.

TP-Link TL-WR840N
StatusVersions
AffectedV2
AffectedV3

Versions not listed are: affected.

TP-Link TL-WR842N
StatusVersions
AffectedV2
AffectedV3
AffectedV4

Versions not listed are: affected.

TP-Link TL-WR842ND
StatusVersions
AffectedV2
AffectedV3
AffectedV4

Versions not listed are: affected.

TP-Link TL-WR845N
StatusVersions
AffectedV1
AffectedV2

Versions not listed are: affected.

TP-Link TL-WR941ND
StatusVersions
AffectedV5
AffectedV6
UnaffectedV6_220610

Versions not listed are: affected.

TP-Link TL-WR945N
StatusVersions
AffectedV1

Versions not listed are: affected.

Versions the record lists as unaffected: V11_211209, V12_230317, V2_241108, V6_220610, V4_201030, V5_201030.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

  • CISA added CVE-2023-50224 to its Known Exploited Vulnerabilities (KEV) catalog on 3 Sep 2025.
  • CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
  • The due date CISA sets for the required action is 24 Sep 2025.
  • The CVE record was published on 3 May 2024, 488 days before it was added to KEV.
  • The CVE record carries a CVSS v3.1 base score of 6.5 (Medium), given by its CNA.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 20% (percentile 97.4), as of 28 Oct 2026.
  • CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact partial.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

  • CWE-290: Authentication Bypass by Spoofing

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

DateEvent
3 May 2024CVE record published
3 Sep 2025Added to CISA KEV
24 Sep 2025CISA due date for the required action
2 Sep 2026CVE record last updated

References

More exploited TP-Link vulnerabilities

  • CVE-2025-9377: TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability (added 3 Sep 2025)
  • CVE-2020-24363: TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability (added 2 Sep 2025)
  • CVE-2023-33538: TP-Link Multiple Routers Command Injection Vulnerability (added 16 Jun 2025)
  • CVE-2023-1389: TP-Link Archer AX-21 Command Injection Vulnerability (added 1 May 2023)
  • CVE-2015-3035: TP-Link Multiple Archer Devices Directory Traversal Vulnerability (added 25 Mar 2022)