Hackers exploiting popular TP-Link WiFi device, WhatsApp also affected
The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that hackers are actively exploiting two vulnerabilities: one affects very popular TP-Link WiFI extenders, and another is a recent WhatsApp flaw exploited by highly sophisticated attackers.
Image by Cybernews.
The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that hackers are actively exploiting two vulnerabilities: one affects very popular TP-Link WiFI extenders, and another is a recent WhatsApp flaw exploited by highly sophisticated attackers.
Based on evidence of active exploitation, CISA has added the two flaws to its known exploited vulnerabilities (KEV) catalog.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” the watchdog warns
The first bug, which has a high severity rating of 8.8 out of 10, impacts a very popular TP-Link TL-WA855RE WiFi range extender, which boosts WiFi coverage.
This device has over 120,500 reviews on Amazon.
However, the vulnerability is now five years old and affects unpatched devices with hardware version V5. Firmware updates have been made available by the vendor.
“TP-Link TL-WA855RE V5 … devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password,” the vulnerability description reads.
CISA instructs federal agencies to apply mitigations or discontinue using the product, as it may no longer be supported or have reached end-of-life.
Hackers commonly target older, vulnerable devices, exploiting known vulnerabilities. They’re constantly scanning for devices with flaws identified between 2016 and 2023, the ShadowServer Foundation data reveals.
The second flaw that CISA warns about affects WhatsApp for iOS devices and Mac computers. WhatsApp and Apple issued an emergency update for an advanced spyware campaign exploiting this bug.
Incomplete authorization of linked device synchronization messages in the app “could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.”
The vendors assess that the flaw may have been exploited in a sophisticated attack against specific targeted users.