[Stanley]

CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploit

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added two security flaws impacting TP-Link wireless routers to its Known Exploited Vulnerabilities (KEV) catalog, noting that there is evidence of them being exploited in the wild.
The vulnerabilities in question are listed below -

CVE-2023-50224 (CVSS score: 6.5) - An authentication bypass by spoofing vulnerability

https://thehackernews.com/2025/09/cisa-f...s-cve.html

[plops]

Is this another one or just stanley covering different outlets saying the same thing.

[The Pact]

The implications look kind of serious. CISA’s recent alert highlights two actively exploited vulnerabilities in TP-Link routers.

I think it's like an authentication bypass by spoofing?

Maybe it is exploiting the `httpd` service listening on TCP port 80?
And it could possibly allow attackers to access stored credentials?

[sharn]

Authentication bypass vulnerabilities are some of the most dangerous because they are silent.
You will not even know you are infected until it is too late.

[Yanix]

It looks like TP-Link got hit again. I guess quick updates now can save a lot of headaches later.

[liukaoxuan]

Which models of the routers are affected