CISA Flags Two Actively Exploited Vulnerabilities: TP-Link Router Reset Flaw and WhatsApp Zero-Day Chain

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, signalling active exploitation in the wild and urging urgent remediation, as reported on 3 September 2025.

The first flaw is CVE-2020-24363 (CVSS 8.8), affecting TP-Link TL-WA855RE V5 20200415-rel37464 devices, where unauthenticated attackers on the same network can trigger a factory reset via a malicious TDDP_RESET POST request, subsequently allowing the attacker to set a new administrative password and take control of the router.

The second vulnerability, CVE-2025-55177 (CVSS 5.4), affects WhatsApp for iOS before v2.25.21.73, WhatsApp Business for iOS before v2.25.21.78, and WhatsApp for Mac before v2.25.21.78, from insufficient authorisation of linked device synchronization messages. Researchers have linked this weakness to a broader spyware campaign, with Amnesty International noting that some individuals believed targeted in the past 90 days were notified, and that the exploit was zero‑click.

Given the active exploitation, agencies are required to apply patches and mitigations by 23 September 2025, with guidance for TP-Link owners to update firmware or segment affected devices and WhatsApp users to upgrade to the latest versions on iOS and macOS.