CVE-2023-50224

CVE-2023-50224 is a vulnerability in the TP-Link WR841N consumer router that APT28 has exploited since 2024 to extract router credentials and modify DNS configuration for adversary-in-the-middle Microsoft 365 credential and OAuth token harvesting. The NCSC advisory published on 7 April 2026 identified the CVE as part of the attribution-backed GRU Unit 26165 campaign.

The vulnerability allows an unauthenticated attacker (or one with access to the router's admin panel, which on many home deployments uses default credentials) to extract sensitive configuration data and modify DNS settings. APT28 uses the access to replace the primary DNS resolver with an attacker-controlled server running dnsmasq-2.85 on UDP 53, selectively routing only Microsoft 365 authentication domains to the attacker for credential interception.

For home-router owners whose hardware matches the affected models, the NCSC's mitigation guidance is: update router firmware to the latest version, change default admin credentials, and avoid exposing the admin interface to the internet. The 2023 publication date of the CVE and its confirmed ongoing exploitation in 2026 underscores the gap between vulnerability disclosure and patching in the consumer-router market.