CVE-2023-50224: TP-Link router httpd authentication bypass exposes stored credentials

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is unauthenticated, network-adjacent, leaks credentials, and is confirmed exploited in CISA KEV, though CVSS rates it only medium severity.

What it is

The httpd service on affected TP-Link router firmware contains an improper authentication flaw (CWE-290) that lets a network-adjacent attacker bypass authentication and read stored credentials. Because no credentials or user interaction are needed, any host on the same network segment can reach the flaw over TCP port 80. The leaked credentials can then be reused to further compromise the device or connected environment.

Impact

An attacker gains disclosure of stored credentials on the router, which can be reused to log in to the device or pivot to other systems using those secrets. This is a confidentiality-only impact; no integrity or availability effect is described.

Attack surface

Reached over the network via the httpd service listening on TCP port 80 by default; the CVSS vector (AV:A/PR:N/UI:N) indicates the attacker must be on an adjacent network segment but needs no authentication and no user interaction.

Exploitation

CVE-2023-50224 is listed in CISA KEV (added 2025-09-03), confirming exploitation in the wild, and EPSS gives a 30-day probability of about 15.6 percent (96.6th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor firmware update for TL-WR841N v12 and any other affected models listed in TP-Link's advisory; patch first.
• If no firmware fix is available for a given model, discontinue use or isolate the device on a segmented network per CISA's required action.
• Restrict management access to the router's HTTP interface so only trusted administrative hosts can reach TCP port 80.
• Change any credentials stored on or reused from the affected router after patching, since they may already be exposed.
• Monitor TP-Link advisories for additional affected models and updated firmware.

Detection

• Monitor network traffic to router TCP port 80 from hosts outside the normal management subnet for requests to credential-handling endpoints.
• Review router and upstream firewall logs for unexpected or unauthenticated HTTP access to the device's web interface.
• Alert on authentication events or configuration changes on the router that originate from unusual source addresses.
• Track CISA KEV status and scan the network for affected TP-Link models still running unpatched firmware.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.