TP-Link · TL-WA855RE
CVE-2020-24363
TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
ما هي
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.
CISA: TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
ما العمل
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
الموعد النهائي للوكالات الفدرالية الأمريكية: 23 سبتمبر 2025
ثغرات مُستغلّة أخرى من TP-Link
| أُضيفت | الثغرة | المنتج | الخطورة | احتمال الهجوم |
|---|---|---|---|---|
| 03/09/2025 | Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection | Multiple Routers | مرتفع 8.6 | 38% |
| 03/09/2025 | Authentication Bypass by Spoofing | TL-WR841N | متوسطة 6.5 | 20% |
| 16/06/2025 | Command Injection | Multiple Routers | مرتفع 8.8 | 42% |
| 01/05/2023 | Archer AX-21 Command Injection | Archer AX21 | مرتفع 8.8 | >99.9% |
| 25/03/2022 | Directory Traversal | Multiple Archer Devices | مرتفع 7.5 | 84% |
المصادر: Known Exploited Vulnerabilities (CISA، ملكية عامة)، وCVE records (cve.org)، وEPSS (FIRST). احتمال الهجوم هو تقدير EPSS لاحتمال أن يحاول أحد استغلال الثغرة خلال الأيام الـ30 القادمة.