CVE-2020-24363

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://malwrforensics.com/en/2020/08/31/cve-2020-24363-tl-wa855re-v5-advisory/Third Party Advisory
https://pastebin.com/VjHM4UiAThird Party Advisory
https://www.tp-link.com/us/support/download/tl-wa855re/#FirmwareProduct
http://malwrforensics.com/en/2020/08/31/cve-2020-24363-tl-wa855re-v5-advisory/Third Party Advisory
https://pastebin.com/VjHM4UiAThird Party Advisory
https://www.tp-link.com/us/support/download/tl-wa855re/#FirmwareProduct
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-24363US Government Resource

Timeline

Published: Aug 31, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Sep 2, 2025
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-243648.8MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. Could lead to RCE via meeting invite.CVE-2020-243658.8An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows a CVE-2020-243663.3Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups.CVE-2020-243677.8Incorrect file permissions in BlueStacks 4 through 4.230 on Windows allow a local attacker to escalate privileges by modifying a file that i CVE-2020-243687.5Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary CVE-2020-243697.5ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference.CVE-2020-243705.3ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).CVE-2020-243715.3lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectga CVE-2020-243727.5LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c.CVE-2020-243738.8A CSRF vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3.CVE-2020-243749.6A DNS rebinding vulnerability in Freebox v5 before 1.5.29.CVE-2020-243756.5A DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3.