CVE-2020-24363
TP-Link Range extenders and access points (TL-WA, RE) · Home and small-office routers, cameras and IoT
TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
At a glance
Exploited. Added to CISA’s catalog of exploited vulnerabilities on September 2, 2025.
Affected product: TP-Link Range extenders and access points (TL-WA, RE) (category Home and small-office routers, cameras and IoT, indicative classification). Name in CISA’s catalog: TP-Link TL-WA855RE.
What should I do?
Apply the patches or mitigations from TP-Link; if none are available, stop using the product. For cloud services, follow the guidance from TP-Link.
Deadline set by CISA for US federal agencies: 21 days (due September 23, 2025). It only binds those agencies, but it is a useful measure of urgency.
- TP-Link security advisories page (general page, not the advisory for this vulnerability)
- The vendor’s specific advisory is listed in the NVD references: CVE-2020-24363 on the NVD website.
Original text of the required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Timeline
- Vulnerability published Publication date (NVD)
- Exploitation confirmed Added to CISA’s KEV catalog
- CISA deadline Remediation deadline set for US federal agencies
The facts, with their sources
- Exploitation confirmed
- Yes, on September 2, 2025 Date added to the catalog of exploited vulnerabilities. Exploitation itself may have started earlier. Source: KEV catalog, collected September 29, 2026 at 14:57 UTC
- Ransomware
- No known use to date That does not guarantee it is not being used: the information is not public. Source: KEV catalog, collected September 29, 2026 at 14:57 UTC
- Hunt for compromise
- Not requested by CISA Source: KEV catalog, collected September 29, 2026 at 14:57 UTC
- CISA required action
- Apply the patches or mitigations from TP-Link; if none are available, stop using the product. For cloud services, follow the guidance from TP-Link. Rewritten by this site from CISA’s original text. Source: KEV catalog, collected September 29, 2026 at 14:57 UTC
- CISA deadline
- September 23, 2025, 21 days Set for US federal agencies: a measure of urgency, not an obligation elsewhere. Source: KEV catalog, collected September 29, 2026 at 14:57 UTC
- Vulnerability published
- August 31, 2020 Source: National Vulnerability Database (NVD), collected September 29, 2026 at 15:00 UTC
- Product according to CISA
- TP-Link TL-WA855RE Filed by this site under “Home and small-office routers, cameras and IoT” (indicative classification). Source: KEV catalog, collected September 29, 2026 at 14:57 UTC
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Technical detail of the score: attack vector, complexity, impact. Source: National Vulnerability Database (NVD), collected September 29, 2026 at 15:00 UTC
Severity and activity
FIRST’s EPSS model. Since exploitation is already confirmed, this figure is mostly useful to compare activity. Collected Sep 29, 2026.
Description
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.
Official description from the NVD, collected Sep 29, 2026. CVE® description © The MITRE Corporation.
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Summary from CISA (KEV catalog).
CERT-FR advisories
No advisory among the latest CERT-FR publications this site follows. That does not mean there are none.
Information reused under the Open Licence 2.0 (Etalab); the date of last update is shown for each advisory. This site is neither affiliated with nor endorsed by ANSSI.
Sources for this page
- CISA KEV catalog: exploitation, date added, required action, deadline, ransomware.
- NVD (NIST): CVSS severity, publication date, description, vendor references.
- EPSS (FIRST): probability of exploitation.
- CERT-FR: advisories and alerts (in French).
- Brand and category: indicative classification by this site (method).