Patch now: TP-Link Archer NX routers vulnerable to firmware takeover

CVE-2023-50224 is an improper authentication flaw (CWE-290) in the httpd service of the TP-Link TL-WR841N router, which listens on TCP port 80 by default; it was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-19899). A network-adjacent attacker with no credentials can send spoofed authentication data to the web interface, bypassing authentication and disclosing stored credentials (including credentials handled by the device's dropbearpwd component). The attacker gains access to sensitive stored credentials, which can be leveraged for further compromise of the router and connected networks; the flaw has high confidentiality impact but no integrity or availability impact (CVSS 6.5, adjacent-network vector). Owners of TL-WR841N routers are affected, and vendor CPE data additionally enumerates related TP-Link firmware products (e.g., MR6400, TL-WDR3600, TL-WDR4300, TL-WR740N series); no specific vulnerable version ranges were provided in the source data. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-09-03, confirming exploitation in the wild (ransomware use unknown), although no public PoC is known.

Do: Apply firmware updates from TP-Link per vendor instructions as required by the CISA KEV listing (follow BOD 22-01 guidance), and because this is an older router line, verify whether your specific hardware revision still receives firmware, replacing or retiring devices that are end-of-life. Until patched, restrict the web management interface to trusted LAN segments, disable WAN-side/remote management on TCP port 80, and rotate admin and WAN credentials (e.g., PPPoE) that may have been disclosed.

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.

TP-Link Archer C7 (EU) and TL-WR841N/ND (MS) routers contain an OS command injection vulnerability (CWE-78) in the Parental Control page of the device's web management interface. By submitting crafted input through that page, an attacker can execute arbitrary operating-system commands on the router with device-level privileges. Users of these specific models are affected, and CISA notes the products may be end-of-life (EoL) and/or end-of-service (EoS), which may limit the availability of fixes. The flaw was added to CISA's KEV catalog on 2025-09-03, indicating known active exploitation in the wild; no public proof-of-concept is known and ransomware use has not been confirmed. EPSS estimates a 33.5% probability of exploitation within the next 30 days (98th percentile), a relatively high likelihood given the vulnerability is unscored.

Do: Inventory networks for Archer C7 (EU) and TL-WR841N/ND (MS) routers and apply the latest firmware from TP-Link if an update is offered for the specific hardware variant. Because the devices may be EoL/EoS and a patch may not be available, CISA's required action is to apply vendor mitigations (or BOD 22-01 guidance for federal agencies) or discontinue use of the product; as interim mitigation, disable WAN-side/remote web management, restrict the admin interface to trusted LAN access, and use strong administrator credentials.