Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-44447

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-21529.

Published

2024-05-03T03:16:00.903

Last Modified

2025-09-04T16:32:26.527

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.0: 6.5 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-290
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System tp-link tl-wr902ac_firmware 231025 Yes
Operating System tp-link tl-wr902ac_firmware 231027 Yes
Hardware tp-link tl-wr902ac 1 No
References