CVE-2020-24363
TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
Description
CVE-2020-24363 is a high-severity missing authentication vulnerability in the TP-Link TL-WA855RE V5 Wi-Fi range extender. An unauthenticated attacker on the same network can send a TDDP_RESET POST request to trigger a factory reset, after which they can set a new administrative password and take full control of the device. With a CVSS v3.1 base score of 8.8, this vulnerability requires no authentication or user interaction, making it trivially exploitable by anyone with adjacent network access. CISA has added CVE-2020-24363 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 23, 2025, and its EPSS score of 11.07% at the 93rd percentile indicates a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| tp-link | tl-wa855re firmware | < 200731 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://malwrforensics.com/en/2020/08/31/cve-2020-24363-tl-wa855re-v5-advisory/(Third Party Advisory)
- https://pastebin.com/VjHM4UiA(Third Party Advisory)
- https://www.tp-link.com/us/support/download/tl-wa855re/#Firmware(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-24363(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CVE-2020-24363 is classified under CWE-306 (Missing Authentication for Critical Function). This weakness occurs when software does not require any authentication for functionality that should demand a verified user identity. In the TP-Link TL-WA855RE V5, the factory reset function via the TDDP_RESET endpoint is exposed without any authentication check, allowing any device on the same network to trigger a complete device reset and subsequently take over the administrative account.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2020-24363 presents a critical access control failure with severe consequences for all three CIA dimensions. The attack vector is adjacent network (AV:A), meaning the attacker must be on the same local network as the TP-Link TL-WA855RE, but no authentication (PR:N) or user interaction (UI:N) is required, and attack complexity is low (AC:L). Confidentiality (High): After resetting the device and setting a new administrative password, the attacker gains full access to the range extender's configuration, including Wi-Fi credentials, connected device information, and network topology details. Integrity (High): The attacker can modify all device settings including DNS configurations, Wi-Fi parameters, and firmware, enabling man-in-the-middle attacks against all devices connecting through the range extender. Availability (High): The factory reset itself causes immediate service disruption for all connected clients, and the attacker can repeatedly reset the device to maintain a denial-of-service condition. The CVSS score of 8.8 reflects the ease of exploitation and the complete impact across all security dimensions once the attacker has adjacent network access.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-24363 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 23, 2025. The EPSS score of 11.07% at the 93rd percentile indicates a high probability of exploitation, placing it in the top 7% of all vulnerabilities by exploitation likelihood. A third-party advisory and detailed writeup is publicly available, providing technical details about the TDDP_RESET request mechanism. The simplicity of the attack, requiring only a single HTTP POST request from the local network, makes it accessible to low-skill attackers and automated exploitation tools. Consumer networking equipment is frequently targeted by botnets seeking to expand their infrastructure, and the combination of no authentication requirement with full device takeover makes this an attractive target.
Remediation
-
Update firmware immediately. Apply the TP-Link firmware update (version 200731 or later) available from the TP-Link firmware download page. This update adds authentication requirements to the TDDP_RESET function.
-
Isolate the device on the network. Place the TL-WA855RE on a dedicated network segment or VLAN to limit exposure from other devices on the network. This reduces the attack surface by restricting which devices can reach the management interface.
-
Change default credentials after patching. After applying the firmware update, set a strong, unique administrative password. Do not reuse passwords from other devices or services.
-
Monitor for unauthorized resets. Watch for unexpected factory resets or configuration changes on the TL-WA855RE. If the device unexpectedly loses its configuration, treat it as a potential indicator of compromise and investigate whether an unauthorized party has gained access.
-
Consider hardware replacement. Given the age of this vulnerability (disclosed in 2020) and the device model, evaluate whether the TL-WA855RE should be replaced with a more current model that receives active security support and implements stronger authentication controls by default.
Technical Details
CVE-2020-24363 exploits a missing authentication flaw in the TP-Link TL-WA855RE V5 range extender running firmware version 20200415-rel37464. The CVSS v3.1 vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the attack requires only adjacent network access with no authentication or user interaction. The vulnerability exists in the TDDP (TP-Link Device Debug Protocol) implementation, specifically the TDDP_RESET endpoint, which accepts unauthenticated POST requests to perform a factory reset. After the reset and reboot cycle completes, all device configurations revert to defaults, and the device enters its initial setup state where the first user to connect can set the administrative password. This creates a race condition that an attacker can reliably win by monitoring the network for the device's reboot and immediately connecting to establish administrative control. The scope is unchanged (S:U), meaning the direct impact is limited to the range extender itself, though a compromised range extender can facilitate attacks against all devices routing traffic through it.
Frequently Asked Questions
Is CVE-2020-24363 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2020-24363 by including it in the Known Exploited Vulnerabilities catalog. The EPSS score of 11.07% at the 93rd percentile further indicates significant exploitation activity. Public technical details about the attack are readily available.
What products are affected by CVE-2020-24363?
The vulnerability affects TP-Link TL-WA855RE V5 Wi-Fi range extenders running firmware versions prior to 200731. The specific firmware version identified as vulnerable is 20200415-rel37464.
How do I fix CVE-2020-24363?
Update the TL-WA855RE V5 firmware to version 200731 or later from the TP-Link support website. After updating, set a strong administrative password and consider isolating the device on a separate network segment. For long-term security, evaluate replacing the device with a currently supported model.
How severe is CVE-2020-24363?
CVE-2020-24363 has a CVSS v3.1 base score of 8.8 (High severity). The vulnerability requires no authentication, making it exploitable by any device on the same network. Successful exploitation results in complete device takeover, enabling traffic interception, configuration manipulation, and denial of service.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.