US Cybersecurity Agency Flags Wi-Fi Range Extender Vulnerability Under Active Attack

The US cybersecurity agency CISA has issued a fresh warning that a missing authentication vulnerability in TP-Link TL-WA855RE Wi-Fi range extender products has been exploited in attacks. Tracked as CVE-2020-24363 (CVSS 8.8), the flaw allows an attacker on the same network to send unauthenticated requests for a factory reset and reboot, potentially leading to incorrect administrative access by setting a new password, according to a NIST advisory.

PoC exploit code targeting the vulnerability has been publicly available since July 2020, and TP-Link previously resolved the issue in firmware EU_V5_200731 before marking the extender as discontinued. On 3 September 2025, CISA added CVE-2020-24363 to its Known Exploited Vulnerabilities catalog, urging federal agencies to remediate by 23 September. The advisory emphasises that affected products could be end-of-life or end-of-service, and users should discontinue product utilisation where possible. There have been no confirmed reports of in-the-wild exploitation prior to the warning.