CVE-2020-24363

What is the TP-Link TL-WA855RE?

The TL-WA855RE is a consumer Wi-Fi range extender, a small device used to boost wireless coverage in homes and small offices by rebroadcasting an existing network signal. Like most consumer networking hardware, its management interface prioritizes ease of setup over defense against attackers already on the local network — an assumption this vulnerability breaks.

Overview

CVE-2020-24363 is a missing-authentication vulnerability (CWE-306) in the TL-WA855RE's TDDP (TP-Link Device Debug Protocol) management interface. An unauthenticated attacker on the same network segment can submit a TDDP_RESET request that triggers a factory reset and reboot of the device — and because the reset process re-initializes the device to an unconfigured state, the attacker can then set a new administrative password and take full control (CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8 High).

Technical Details

TDDP is a proprietary TP-Link protocol intended for device debugging and management, and this endpoint fails to require any authentication before accepting a destructive factory-reset command. Because a factory reset returns the device to its out-of-box unconfigured state, the attacker — who is already on the adjacent network by the time they can reach TDDP — simply needs to complete the device's normal initial setup flow (which assumes a trusted local user) to claim administrative control.

Discovery

Publicly tracked via NVD; the TL-WA855RE is listed by TP-Link as end-of-life/end-of-service, meaning no further security patches are planned.

Exploitation Context

CISA added this CVE to KEV in September 2025, five years after disclosure, indicating continued exploitation of these devices — likely for botnet recruitment or as a pivot point for further network attacks, since a compromised range extender sits inline with victim network traffic.

Remediation

1. Discontinue use of the TL-WA855RE and replace with a currently supported range extender or access point — TP-Link is not issuing further patches for this end-of-life model.
2. If replacement isn't immediately possible, restrict which devices can reach the extender on the local network, using client isolation or a dedicated VLAN if your router supports it.
3. Monitor for unexpected factory resets or configuration changes on any TL-WA855RE still in service, which could indicate active exploitation.
4. Audit your network for other end-of-life TP-Link devices, given this vendor's product line includes many older models no longer receiving security updates.