CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
Affected products
tp-link: tl-wr841n firmware; tp-link: tl-wr841n; tp-link: mr6400 firmware; tp-link: mr6400; tp-link: tl-wdr3600 firmware; tp-link: tl-wdr3600; tp-link: tl-wdr4300 firmware; tp-link: tl-wdr4300; tp-link: wdr3500 firmware; tp-link: wdr3500; tp-link: tl-wr710n firmware; tp-link: tl-wr710n; tp-link: tl-wr740n firmware; tp-link: tl-wr740n; tp-link: tl-wr741nd firmware
References6
- www.tp-link.com/us/support/faq/5058/ Vendor Advisory
- www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware Product
- www.zerodayinitiative.com/advisories/ZDI-23-1808/ Third Party Advisory
- www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware Product
- www.zerodayinitiative.com/advisories/ZDI-23-1808/ Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 20% percentile: 97 · as of 3 November 2026
- CWE
- CWE-290
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.