Description (CNA)
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TP-Link / TL-WR841N | affected 3.16.9 build 200409; affected V8; affected V9; affected V10; affected V11; unaffected V11_211209; affected V12; unaffected V12_230317 |
| TP-Link / TL-WR841ND | affected V8; affected V9; affected V10; affected V11; unaffected V11_211209; affected V12; unaffected V12_230317 |
| TP-Link / TL-MR6400 | affected V1; affected V2 |
| TP-Link / Archer C5 | affected V2 |
| TP-Link / Archer C7 | affected V2; unaffected V2_241108; affected V3 |
| TP-Link / TL-WDR3600 | affected V2 |
| TP-Link / TL-WDR4300 | affected V1 |
| TP-Link / TL-WDR3500 | affected V2 |
| TP-Link / TL-WR740N | affected V4; affected V5; affected V6; affected V7 |
| TP-Link / TL-WR741ND | affected V4; affected V5; affected V6 |
| TP-Link / TL-WR749N | affected BR 6.0; affected BR 7.0 |
| TP-Link / TL-MR3420 | affected V2; affected V3; affected V4 |
| TP-Link / TL-WR1043ND | affected V2; affected V3; affected V4 |
| TP-Link / TL-WR1045ND | affected RU V2 |
| TP-Link / TL-WR840N | affected V2; affected V3 |
| TP-Link / TL-WR842N | affected V2; affected V3; affected V4 |
| TP-Link / TL-WR842ND | affected V2; affected V3; affected V4 |
| TP-Link / TL-WR845N | affected V1; affected V2 |
| TP-Link / TL-WR941ND | affected V5; affected V6; unaffected V6_220610 |
| TP-Link / TL-WR945N | affected V1 |
| TP-Link / TL-WA801ND | affected V3; affected V4 |
| TP-Link / TL-WA901ND | affected V3; affected V4; unaffected V4_201030; affected V5; unaffected V5_201030 |
CWE
CWE-290
References
- https://www.zerodayinitiative.com/advisories/ZDI-23-1808/
- https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware
- https://www.tp-link.com/us/support/faq/5058/
ADP enrichment
No English description supplied.
No English description supplied.