An Important Update for TP-Link Customers Regarding Recent CVE-2023-50224 Reporting

Over the past few days, the UK's National Cyber Security Centre (NCSC), in coordination with the U.S. FBI and Germany's Federal Office for the Protection of the Constitution, published advisories describing an exploit used by a cyber actor, listing TP-Link among the brands of targeted routers. While headlines have been broad, we'd like to clarify what the advisories actually mean and how it may impact you.

What Has Happened:

The vulnerability named in the report is CVE-2023-50224, an exploit that allowed attackers to redirect traffic to harvest login credentials and passwords for web and email related services, mainly targeting outdated small office/home office (SOHO) routers.

The affected models are legacy devices that reached End of Service and Life (EOSL) status several years ago and no longer receive regular updates. The list of affected products based on our current assessment can be found here.

What Should I Do:

For U.S. customers, a resolution is already underway. The FBI has conducted a court-authorized operation that reset compromised routers and removed the attackers' access.

If you own one of the affected models, the most effective step you can take is to replace the device with one that is currently supported and receiving regular security updates. All routers, like any internet-facing device, have a security lifespan, which is true regardless of the manufacturer. Utilizing end-of-life networking equipment carries a real risk because vulnerabilities that emerge after support ends cannot always be patched.

If continued use of a legacy device is unavoidable, we recommend taking the following precautions:

Install the latest firmware available for your specific model, where one exists. Not all models may have a patch due to hardware limitations, platform age, and lack of available test units.
Disable remote management, if possible, along with any unnecessary services.
Restrict device access to trusted internal networks only.
Monitor network activity for unusual behavior or unauthorized configuration changes.

What We Are Doing:

Although these devices are outside our standard maintenance window, our team has developed updates for several of the affected models where it is technically feasible to do so. These updates are published on our sites alongside the affected model list, which can be found here.

To be transparent, there are limits to what is possible with products that have been discontinued. Where a patch cannot be developed, our recommendation is to upgrade to a currently supported device. This is about security, not sales, because legacy hardware cannot always be secured against vulnerabilities that emerge after its support window ends.

For our currently supported product lines, we maintain an active firmware update program and a published process for vulnerability disclosure. TP-Link is committed to the safety of our users and will continue to actively monitor the situation, disclose new information as it develops, and support customers with questions about their specific devices.

If you have questions that are not addressed in this post or in our security advisory, our support teams are available to help. support.usa@tp-link.com