CVE-2023-50224TP-LinkRouters and networkingSeptember 3, 2025

TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

Medium 6.5Actively exploited

Description

TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Running TP-Link devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on TP-Link alerts

Details

Vendor
TP-Link
Product
TL-WR841N
CVE
CVE-2023-50224
Affected versions
TL-WR841N: version not specified
TL-WR841N: from 11_150616 to before 11_211209 — fixed in 11_211209
TL-WR841N: from 12_160624 to before 12_230317 — fixed in 12_230317
MR6400: version not specified
TL-WDR3600: version not specified
TL-WDR4300: version not specified
WDR3500: version not specified
TL-WR710N: version not specified
TL-WR740N: version not specified
TL-WR741ND: version not specified
TL-WR743ND: version not specified
WR749N: version not specified
MR3420: version not specified
WR1043ND: version not specified
WR1045ND: version not specified
WR802N: version not specified
TL-WR810N: version not specified
TL-WR840N: version not specified
WR841HP: version not specified
TL-WR841ND: version not specified
WR842N: version not specified
WR842ND: version not specified
TL-WR843N: version not specified
WR845N: version not specified
WR945N: version not specified
TL-MR3020: version not specified
TL-MR3220: version not specified
WA701ND: version not specified
WA801ND: version not specified
Archer C5: from 2_150130 to before 2_260429 — fixed in 2_260429 (from the advisory and NVD; check the exact builds in the official advisory)
CVSS score
6.5
Actively exploited
Yes, listed in the CISA Known Exploited Vulnerabilities catalog
CISA due date
September 24, 2025 (deadline for US federal agencies: a good benchmark for you too)
Source
CISA KEV – original advisory
Published
September 3, 2025

The description and the recommended action are quoted from the public advisory; severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.

More TP-Link advisories