CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation

CISA has added TP-Link TL-WA855RE Wi‑Fi Ranger Extender flaws to its Known Exploited Vulnerabilities (KEV) catalog amid evidence of active exploitation, according to CISA. The vulnerability, CVE-2020-24363 (CVSS 8.8), involves missing authentication that could let an unauthenticated attacker on the same network submit a factory‑reset request and then set a new administrative password.

TP-Link notes a fixed firmware TL-WA855RE(EU_V5_200731) but brands the device end‑of‑life, suggesting users replace it with a newer model. In addition, a WhatsApp flaw, CVE-2025-55177 (CVSS 5.4), has been added to KEV as being exploited in a highly targeted spyware campaign linked to an iOS/macOS vulnerability (CVE-2025-43300, CVSS 8.8), with WhatsApp stating it sent threat notifications to fewer than 200 users. Federal Civilian Executive Branch agencies are urged to apply mitigations by 23 September 2025 for both vulnerabilities to counter active threats.