CISA Alerts on TP-Link Authentication Flaw Under Active Exploitation

CISA has issued an alert about a serious security hole in certain TP-Link devices, tracked as CVE-2020-24363, which allows an attacker on the same network to take control without a password and is already under active exploitation. TP-Link TL-WA855RE devices are affected by missing authentication for a critical function, meaning a factory-reset command is not checked for the sender.

An attacker could reboot the device via a crafted request, restore it to factory settings, and then set a new admin password, potentially locking out the legitimate owner and enabling changes to network settings, traffic spying, or service disruption. CISA labels this issue as under active exploitation, with attackers already using it in real attacks.

The guidance includes applying vendor mitigations from TP-Link, following White House Binding Operational Directive 22-01 for cloud services, and discontinuing use or replacing with a modern, supported model if no fix is available. The alert underscores the importance of firmware reviews and prompt updates where possible. according to CISA.