U.S. CISA adds WhatsApp, and TP-link flaws to its Known Exploited Vulnerabilities catalog

According to U.S. Cybersecurity and Infrastructure Security Agency (CISA), WhatsApp and TP-Link flaws have been added to its Known Exploited Vulnerabilities catalog. The listed CVEs are CVE-2020-24363 for TP-Link TL-WA855RE Missing Authentication for Critical Function Vulnerability and CVE-2025-55177 for Meta Platforms WhatsApp Incorrect Authorization Vulnerability, with CVSS 8.8 noted for the TP-Link flaw.

Exploitation details were not disclosed for the TP-Link issue, and the WhatsApp vulnerability is linked to a zero-click exploit that has been used to hack WhatsApp users, with Amnesty researchers and others noting the activity. WhatsApp has stated it patched the flaw exploited by attackers, but the risks remain, and the exploit targets an authorization bypass issue in WhatsApp on iOS and macOS.

CISA also notes that agencies must address these vulnerabilities by 23 September 2025, in line with the Binding Operational Directive Reducing the Significant Risk of Known Exploited Vulnerabilities.