CVE-2020-24363: TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-09-02. EPSS: 20.7% chance of exploitation in the next 30 days.

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.

Affected products

• TP-Link TL-WA855RE Firmware: before 200731 (fixed in 200731)

Published 2020-08-31. Last modified 2026-06-17.