VYPR
← All advisories
Medium severity6.5NVD Advisory· Published May 3, 2024· Updated Jun 17, 2026

CVE-2023-44447

CVE-2023-44447

Description

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-21529.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • TP-Link/Tl Wr902ac Firmware2 versions
    cpe:2.3:o:tp-link:tl-wr902ac_firmware:231025:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:tp-link:tl-wr902ac_firmware:231025:*:*:*:*:*:*:*
    • cpe:2.3:o:tp-link:tl-wr902ac_firmware:231027:*:*:*:*:*:*:*
  • TP-Link/TL-WR902ACllm-fuzzy2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: TL-WR902AC(EU)_V1_170628

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.