What’s Vulnerable › Vulnerabilities

CVE-2020-24363: TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-09-02
• EPSS: 22.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-08-31 · updated 2026-06-17
• Weakness: CWE-306

Description

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.

Affected products

• TP-Link TL-WA855RE: before 200731 — fixed in 200731

How to fix

Upgrade to a fixed version: TP-Link TL-WA855RE 200731. Check the vendor advisory for mitigations.

References

• http://malwrforensics.com/en/2020/08/31/cve-2020-24363-tl-wa855re-v5-advisory/
• https://pastebin.com/VjHM4UiA
• https://www.tp-link.com/us/support/download/tl-wa855re/#Firmware
• http://malwrforensics.com/en/2020/08/31/cve-2020-24363-tl-wa855re-v5-advisory/
• https://pastebin.com/VjHM4UiA
• https://www.tp-link.com/us/support/download/tl-wa855re/#Firmware
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-24363

Get alerted when CVE-2020-24363 or the next vulnerability affects your stack