CVE-2023-44447 - CVE House
Back to Database
Status published Medium CVE-2023-44447

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability

Vulnerability Description

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-21529.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-44447

Credits & Attribution

No credits recorded in the NVD database.

References

More from TP-Link

View All →
CVE-2025-40634
Stack-based buffer overflow in TP-Link Archer AX50
Critical 9.2
CVE-2025-3442
Information Disclosure Vulnerability in TP-Link Tapo IoT Smart Hub
Medium 4.4
CVE-2025-1099
Information Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi Camera
High 7
CVE-2025-0730
TP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query strings
Medium 6.3
CVE-2025-0729
TP-Link TL-SG108E clickjacking
Medium 6.9

Affected Vendor

Affected Software

TL-WR902AC
Vulnerable Versions:
TL-WR902AC(EU)_V1_170628

Timeline

Official Publish: May 3rd, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-290

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Collection
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access