CVE-2020-24363 TP-Link TL-WA855RE: login or permission bypass
In plain words: A door that should be locked is not: part of the system can be reached without a valid login or permission. The attacker gets in as a user or administrator without knowing a password.
Confirmed exploited by CISA on · US federal patch deadline Sep 23, 2025
What to do
- Install TP-Link's security update for TL-WA855RE. If no update exists, follow the vendor's workaround or stop using the product until one ships.
- Turn on automatic firmware updates and replace gear the maker no longer supports.
- Change default passwords and switch off remote administration and features you do not use.
- Do not put storage boxes or cameras directly on the internet — use the maker's app or a VPN.
Who is affected
Could reach you. This one is aimed at devices or apps of the kind people own.
What's at risk: Taken over in bulk to join botnets, used to watch your traffic, or — for storage boxes — locked by ransomware.
The details
- Official name
- TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
- Product
- TP-Link TL-WA855RE
- CISA description
- TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Type of flaw
- Login or permission bypass (CWE-306)
- Confirmed exploited
- Sep 2, 2025
- US federal patch deadline
- Sep 23, 2025
Ask Cleus about it
Ask about a vulnerability, an update, a weird message, or the news. Plain-word answers, free, no account.
Answering about CVE-2020-24363 ·
Questions about CVE-2020-24363
Is CVE-2020-24363 being exploited?
Yes. CISA added CVE-2020-24363 to its Known Exploited Vulnerabilities catalog on Sep 2, 2025, which means there is reliable evidence of real-world attacks.
How do I fix CVE-2020-24363?
Install TP-Link's security update for TL-WA855RE. If no update exists, follow the vendor's workaround or stop using the product until one ships. Turn on automatic firmware updates and replace gear the maker no longer supports.
Am I affected by CVE-2020-24363?
Only if you use TP-Link TL-WA855RE. This one is aimed at devices or apps of the kind people own.