CVE-2023-50224Active Exploitation(tp-link / archer_c1900)

TP-Link 產品的安全性在市場上評價兩極。其產品具備基本加密與NCC認證，但近年來因多項高風險資安漏洞（如 CVE-2023-50224, CVE-2025-9377）遭披露，且曾被指控遭黑客利用，導致其安全性備受爭議。 國家資通安全研究院 國家資通安全研究院 +3 關鍵安全性觀點： 安全漏洞風險： 研究發現多款舊型或特定型號 TP-Link 路由器存在「敏感資訊洩露」和「命令注入」漏洞，已被攻擊者用於建立殭屍網路。 技術與隱私防護： TP-Link 聲明其 Tapo 攝像頭使用安全可靠的 AWS 伺服器，且無「預設密碼」登錄，支援加密傳輸。 政治與背景疑慮： 美國曾因資安風險考慮封殺 TP-Link，指出其設備可能成為中國駭客攻擊工具。 建議操作： 用戶需定期更新韌體、更改預設管理員密碼、停用遠端管理功能以保障安全。 國家資通安全研究院 國家資通安全研究院 +8 總結來說，若能勤於更新韌體並妥善設定，TP-Link 設備可作為一般的家庭網路使用，但若對隱私與中國背景資安風險極度敏感，建議考慮其他品牌。

I dug into the complaints and the federal record There is actually a pretty substantial technical history behind this The biggest one is CVE-2023-50224. Russian GRU operators exploited vulnerable TP-Link routers, and the NSA/FBI say thousands of TP-Link routers were compromised. The attackers used the routers for DNS hijacking, redirecting victims' DNS requests through attacker-controlled infrastructure There are other examples too, CVE-2023-33538, a TP-Link command-injection vulnerability, was added to CISA's Known Exploited Vulnerabilities catalog because there was evidence it was being actively exploited And the Florida investigation didn't suddenly appear today. Florida's AG opened a consumer-protection investigation and subpoenaed TP-Link in December 2025, specifically asking about its security practices, software development, supply chain, corporate structure and handling of U.S. consumer data Then in April 2026, the FBI and NSA publicly said Russian military intelligence had been exploiting TP-Link routers to steal credentials and use compromised routers for DNS-hijacking operations longer post coming soon

Hackers found a way to turn some TP-Link routers into machines that secretly redirected people's internet traffic The attack was tied to APT28, the Russian military intelligence group One of the vulnerabilities they exploited was CVE-2023-50224 in older TP-Link routers The flaw could let an attacker retrieve sensitive information from the router, including stored credentials Once they had those credentials, they could change the router's DNS settings DNS is what helps your device turn a website name like http://gmail.com into the server address it needs to connect to The attackers replaced the router's legitimate DNS server with one they controlled And because devices connected to the router inherited those DNS settings, the compromise could extend beyond the router itself The attackers weren't necessarily trying to redirect everything The malicious DNS servers could look for requests involving specific services, particularly login pages and email services When a targeted request appeared, the DNS infrastructure could send the victim toward attacker-controlled infrastructure That gave the attackers an opportunity to steal credentials and authentication tokens The UK government said the operation was being used to carry out adversary-in-the-middle attacks And TP-Link wasn't dealing with just this one vulnerability CISA has also listed another TP-Link flaw, CVE-2023-33538, in its catalog of vulnerabilities known to have been exploited in the wild That vulnerability could allow attackers to execute commands on affected routers The more uncomfortable detail is what TP-Link now says about some of the routers affected by CVE-2023-50224 Several are old models that have reached end-of-life Some cannot receive a security patch at all So a vulnerability discovered years ago can still matter because the vulnerable router may still be sitting in someone's home or office, doing exactly what a router is supposed to do: sitting in the middle of their network and handling their traffic This is the security history sitting underneath the lawsuits filed against TP-Link this week The political claims about China are a separate question that will have to be established in court But the underlying router-security problem isn't hypothetical Security agencies have documented real exploitation of TP-Link devices by state-linked attackers

Huh huh. Päivitä laitteesi. "GRU on viime vuosina hyödyntänyt erit. heikosti suojattuja kotireitittimiä osana maailmanlaajuista kybervakoiluinfrastruktuuriaan. Operaatio kohdistui GRU:n murtamiin TP-Linkin reitittimiin, joissa ei ollut korjattu CVE-2023-50224 haavoittuvuutta."

Netomize shares the PacketSmith Yara detection module rule and a pcap for detecting attempted exploitation of the CVE-2023-50224 vulnerability in TP-Link TL-WR841N devices. #apt28 #CVE-2023-50224 https://github.com/Netomize/RFiles/tree/main/cve_2023_50224

これっぽいね。 CVE-2023-50224 https://www.tp-link.com/us/support/faq/5058/

"Finnish authorities participated in an international operation to disrupt the cyber espionage activities of the Russian military intelligence service GRU." 👉TP-Link routers that had not been patched for a vulnerability known as CVE-2023-50224. https://www.is.fi/digitoday/tietoturva/art-2000011929820.html

@AVejmelka @honzabartosek @NUKIB_CZ Aby to bylo ještě pikatnější, tak navíc na tu chybu upozornil Rus. Tedy chybu CVE-2023-50224 oznámil Aleksandar Djurdjevic (přezdívka revengsmK), který ji nahlásil přes Zero Day Initiative (ZDI-23-1808) v roce 2023. Chápeš jak je to trapné?

Top 5 Trending CVEs: 1 - CVE-2024-7399 2 - CVE-2023-50224 3 - CVE-2025-48700 4 - CVE-2025-20333 5 - CVE-2026-5281 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

Nothing—the NSA deployed no such thing. The April 7 FBI/NSA advisory warns that Russian GRU (APT28/Fancy Bear) hackers have been exploiting vulnerable home/office routers worldwide (e.g., TP-Link via CVE-2023-50224) since at least 2024 to hijack DNS settings, steal credentials, and spy on military/government traffic. They disrupted some of these networks. Rebooting (plus firmware updates, password changes, and disabling remote access) is standard advice to clear attacker implants or changes. No backdoors involved—just basic cyber hygiene against foreign espionage.

APT28 exploits vulnerabilities like CVE-2023-50224 in TP-Link routers to gain remote administrative access. Attackers change the device's default DNS resolvers to actor-controlled servers. #cybersecurity #router #DNS #exploits #CVE

https://joho-todai.com/russia-gru-hijacks-routers-steal-outlook-credentials/ > 脆弱性（CVE-2023-50224）を悪用してルーターの認証情報を取得する。次に、そのルーターのDHCP/DNS設定を書き換え、攻撃者が管理するDNSサーバーを指すように変更する。 対象機器は使っていないけど, 汎用的には, 定期的に Plan して State 差分を検出ですかね？

APT28 exploited CVE-2023-50224 in SOHO routers to hijack DNS settings, redirecting traffic through attacker-controlled infrastructure. The campaign intercepted credentials from 5,000+ devices across 120 countries via adversary-in-the-middle attacks. Runtime segmentation helps contain such lateral movement from compromised network devices. #ThreatIntel 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/apt28-2025-soho-router-dns-hijacking

Russian 🇷🇺 APT28 (GRU Unit 26165) exploits vulnerable routers including TP-Link WR841N via CVE-2023-50224 to hijack DNS settings for adversary-in-the-middle attacks. Campaign targets email/login traffic for credential harvesting. #DFIR_Radar

A pressão política é alimentada por um histórico técnico assustador: • Em 2024, a Microsoft achou 8 mil roteadores da marca formando uma rede zumbi (botnet). • Em abril de 2026, o FBI flagrou a inteligência militar russa hackeando os aparelhos (via CVE-2023-50224) para interceptar senhas e alterar o DNS das vítimas.

@MGabalins @kursorslv Izskatās, ka šis ir par CVE-2023-50224 un tas attiecas uz TP-Link TL-WR841N ar 3.16.9 build 200409 / hardware version 12

The most common router model that was exploited in the wind - TP Link WR841N using CVE-2023-50224. This vulnerability allows adversaries to steal credentials of the router via HTTP GET requests. Once the actors gained credentials of the router, a second request was sent to alter the DHCP DNS settings of the router, setting the DNS server to a malicious VPS server.

TP-Linkルーター、サポート終了なら今夜確認を　20機種がGRUに掌握されDNSを書き換えられていた /Archer C5・WR841N・CVE-2023-50224・APT28・Outlook. https://youtu.be/nSCjY_AGgF4?si=5_ZAFMDLk301jLkb

⚠️ Votre MFA est contournée si votre routeur est vulnérable ! APT28 utilise CVE-2023-50224 pour attaques "AiTM" et voler vos tokens. Sécurisez vos équipements de bordure. #CyberResilience https://www.lemagit.fr/actualites/366641249/APT28-lexploitation-des-routeurs-SOHO-comme-levier-despionnage https://t.co/MjWdFPhVZR

TRC analysis shows state-backed attackers exploited CVE-2023-50224 and CVE-2025-30237 to establish persistent router access, then used DNS manipulation for credential harvesting across 8,000+ devices. Router compromise creates upstream control points that traditional endpoint security cannot address. 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/tp-link-sued-four-more-us-states-router-security-china-ties-2026 #ThreatIntel #CloudSecurity