CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, signaling immediate cyber threats. One critical flaw, CVE-2020-24363, impacts TP-Link TL-WA855RE Wi-Fi Ranger Extenders, allowing unauthenticated attackers to gain administrative control, a significant risk given the product's end-of-life status means no further patches. The second, CVE-2025-55177, is a WhatsApp vulnerability exploited in a highly targeted spyware campaign, chained with an Apple OS flaw (CVE-2025-43300), affecting fewer than 200 users. Federal Civilian Executive Branch agencies are mandated to implement mitigations for both by September 23, 2025, underscoring the persistent and evolving nature of cyber risks.

Analysis

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has elevated two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are being actively used in attacks and mandating mitigation for federal agencies by September 23, 2025. The first, a high-severity flaw in TP-Link's TL-WA855RE Wi-Fi extenders (CVE-2020-24363, CVSS 8.8), allows for a complete, unauthenticated device takeover. Critically, this product has reached its end-of-life, meaning no security patches will be issued, creating a permanent risk for any organization still deploying this hardware. The second issue involves a chained exploit utilizing a WhatsApp flaw (CVE-2025-55177) and a high-severity Apple operating system vulnerability (CVE-2025-43300, CVSS 8.8). While the attack campaign was described as highly-targeted, affecting fewer than 200 users, the involvement of an Apple OS flaw justifies the strong negative sentiment score (-0.7) for AAPL. For a premium brand like Apple, which emphasizes security, any confirmed exploitation of its ecosystem represents a tangible reputational risk, even if the immediate market impact is assessed as low.

Key Decisions for Investors

• Investors in Apple (AAPL) should monitor for any evidence that the high-severity OS vulnerability (CVE-2025-43300) is being exploited more broadly, as this could escalate reputational damage beyond the current targeted campaign.
• The CISA directive highlights the persistent risk of unpatched, end-of-life hardware, potentially benefiting cybersecurity firms specializing in network discovery, threat intelligence, and device lifecycle management.
• While the negative sentiment for Apple is notable, the highly targeted and limited scope of the attack (less than 200 users) suggests the immediate financial impact is contained, counseling against overreacting to the headline risk for now.