PT-2023-7980 · Tp Link · Tp-Link Tl-Wr841N
Aleksandar Djurdjevic
+1
·
Published
2023-02-24
·
Updated
2026-05-22
·
CVE-2023-50224
CVSS v3.1
6.5
Medium
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
TP-Link TL-WR841N versions (affected versions not specified)
Description
The TP-Link TL-WR841N router is affected by an improper authentication issue within the dropbearpwd component. This allows network-adjacent attackers to disclose sensitive information on affected devices. Authentication is not required to exploit this issue. The flaw resides in the httpd service, listening on TCP port 80 by default, due to improper authentication. An attacker can leverage this to reveal stored credentials, potentially leading to further compromise. Real-world exploitation has been observed with the Russian APT28 (GRU Unit 26165) using this vulnerability (CVE-2023-50224) to hijack DNS settings for adversary-in-the-middle attacks, intercepting credentials from over 5,000 devices across 120 countries. The campaign targeted email and login traffic for credential harvesting.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Information Disclosure
Authentication Bypass by Spoofing
Improper Access Control
Incorrect Privilege Assignment
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tp-Link Tl-Wr841N