Is CVE-2020-24363 exploited in the wild?

Yes. CVE-2020-24363 is known to be exploited in the wild, first recorded on 2 September 2025. Treat it as urgent.

How severe is CVE-2020-24363?

Critical severity, with a CVSS score of 8.8, published 2 September 2025.

Which products and versions are affected?

TP-Link TL-WA855RE firmware V5 versions up to (excluding) 200731.

Is there a fix for CVE-2020-24363?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-24363 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2020-24363?

Check whether you run TP-Link TL-WA855RE or TP-Link TL-WA855RE firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-24363: TP-Link TL-WA855RE missing authentication for factory reset

CVE-2020-24363 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-09-02

A vulnerability in the TP-Link TL-WA855RE Wi-Fi range extender allows an unauthorized person on the same network to remotely reset the device to its factory settings. By forcing a reset, an attacker can then set their own administrative password, effectively taking full control of the device. This can lead to a complete loss of network privacy and allow the attacker to intercept or redirect internet traffic.

Vendors: TP-Link.

Quick answers

Is CVE-2020-24363 exploited in the wild?: Yes. CVE-2020-24363 is known to be exploited in the wild, first recorded on 2 September 2025. Treat it as urgent.
How severe is CVE-2020-24363?: Critical severity, with a CVSS score of 8.8, published 2 September 2025.
Which products and versions are affected?: TP-Link TL-WA855RE firmware V5 versions up to (excluding) 200731.
Is there a fix for CVE-2020-24363?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-24363 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2020-24363?: Check whether you run TP-Link TL-WA855RE or TP-Link TL-WA855RE firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The TP-Link TL-WA855RE (specifically V5) fails to require authentication for critical functions handled via the Test and Detection Data Protocol (TDDP). An unauthenticated attacker on the same local network or Wi-Fi segment can send a crafted 'TDDP_RESET' POST request to the device. This triggers a factory reset and reboot, clearing existing credentials. The attacker can then access the setup interface to establish a new administrative password, granting them full control over the device configuration. This vulnerability is confirmed to have been exploited in the wild.

Affected products

TP-Link TL-WA855RE firmware V5 versions up to (excluding) 200731

Timeline

2020-08-31: disclosed
2020-08-31: advisory
2025-09-02: kev added: Added to CISA Known Exploited Vulnerabilities catalog.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.