Missing Authentication in TP‑Link TL‑WA855RE (CVE‑2020‑24363) Enables Unauthorized Factory Reset
What It Is – The TL‑WA855RE Wi‑Fi range extender lacks authentication on its TDDP_RESET endpoint. An unauthenticated attacker on the same LAN can issue a POST request that forces a factory reset and reboot, then set a new admin password.
Exploitability – The flaw is exploitable without credentials and requires only local‑network access. Public PoC scripts exist; CVSS is rated 7.5 (High).
Affected Products – TP‑Link TL‑WA855RE (including end‑of‑life/EoS units).
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous verification that critical device functions are protected by strong authentication – a core access‑control assurance point.
- Demonstrates how missing controls can break the audit trail; without proper logging of reset events, organizations lose defensible evidence of device state changes.
- Signals to buyers that a robust identity‑and‑access program must extend to network‑infrastructure assets, not just servers and SaaS apps.
Recommended Actions
- Inventory all TL‑WA855RE units and verify firmware is up‑to‑date; apply TP‑Link’s security patch if available.
- If the device is EoL/EoS, replace it with a supported model that enforces authentication on management interfaces.
- Disable remote management and place the extender in a segmented VLAN with strict inbound ACLs.
- Enable logging of reset/reboot events on the network and integrate them into your SIEM for continuous monitoring.
- Document the authentication controls for the device in your access‑control policy to provide audit‑ready evidence.
Source: CISA KEV – CVE‑2020‑24363