# CVE-2020-24363: TP-Link TL-WA855RE missing authentication for factory reset

Source: https://junglewise.ai/threats/cve-2020-24363-tp-link-tl-wa855re-missing-authentication-for-factory-reset  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-02. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2020-24363 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-09-02

A vulnerability in the TP-Link TL-WA855RE Wi-Fi range extender allows an unauthorized person on the same network to remotely reset the device to its factory settings. By forcing a reset, an attacker can then set their own administrative password, effectively taking full control of the device. This can lead to a complete loss of network privacy and allow the attacker to intercept or redirect internet traffic.

Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2020-24363 exploited in the wild?** Yes. CVE-2020-24363 is known to be exploited in the wild, first recorded on 2 September 2025. Treat it as urgent.

**How severe is CVE-2020-24363?** Critical severity, with a CVSS score of 8.8, published 2 September 2025.

**Which products and versions are affected?** TP-Link TL-WA855RE firmware V5 versions up to (excluding) 200731.

**Is there a fix for CVE-2020-24363?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-24363 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2020-24363?** Check whether you run TP-Link TL-WA855RE or TP-Link TL-WA855RE firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The TP-Link TL-WA855RE (specifically V5) fails to require authentication for critical functions handled via the Test and Detection Data Protocol (TDDP). An unauthenticated attacker on the same local network or Wi-Fi segment can send a crafted 'TDDP_RESET' POST request to the device. This triggers a factory reset and reboot, clearing existing credentials. The attacker can then access the setup interface to establish a new administrative password, granting them full control over the device configuration. This vulnerability is confirmed to have been exploited in the wild.

## Affected products

- TP-Link TL-WA855RE firmware V5 versions up to (excluding) 200731

## Timeline

- 2020-08-31: disclosed
- 2020-08-31: advisory
- 2025-09-02: kev added: Added to CISA Known Exploited Vulnerabilities catalog.