CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation
Summary: CISA added CVE-2020-24363, a missing-authentication flaw (CVSS 8.8) in end-of-life TP-Link TL-WA855RE range extenders that lets an unauthenticated attacker on the same network send a TDDP_RESET request to factory reset the device and set a new admin password, to its KEV catalog citing active exploitation. CISA also added CVE-2025-55177 (CVSS 5.4), a WhatsApp flaw disclosed last week and chained with an Apple iOS, iPadOS, and macOS vulnerability (CVE-2025-43300, CVSS 8.8) in a highly targeted spyware campaign, with WhatsApp sending in-app threat notifications to fewer than 200 users.
What you should know: The TP-Link device is end-of-life and unlikely to receive patches, so the fix is replacement, not updating. On the WhatsApp side, fewer than 200 users were notified, and CISA gave federal agencies until September 23, 2025 to apply mitigations.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-24363CVE-2025-43300CVE-2025-55177
- Related
- Microsoft Patch Tuesday, September 2025 Edition Cyber Risks ·