auren-research/cyber-sec huggingface dataset:
cveID: CVE-2010-3962
vendorProject: Microsoft
product: Internet Explorer
vulnerabilityName: Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
dateAdded: 2025-10-06
shortDescription: Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-27
knownRansomwareCampaignUse: Unknown
notes: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/2458511?redirectedfrom=MSDN ; https://nvd.nist.gov/vuln/detail/CVE-2010-3962
cveID: CVE-2021-43226
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Privilege Escalation Vulnerability
dateAdded: 2025-10-06
shortDescription: Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-27
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43226 ; https://nvd.nist.gov/vuln/detail/CVE-2021-43226
cveID: CVE-2013-3918
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Out-of-Bounds Write Vulnerability
dateAdded: 2025-10-06
shortDescription: Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-27
knownRansomwareCampaignUse: Unknown
notes: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090 ; https://nvd.nist.gov/vuln/detail/CVE-2013-3918
cveID: CVE-2011-3402
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Remote Code Execution Vulnerability
dateAdded: 2025-10-06
shortDescription: Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-27
knownRansomwareCampaignUse: Unknown
notes: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087 ; https://nvd.nist.gov/vuln/detail/CVE-2011-3402
cveID: CVE-2010-3765
vendorProject: Mozilla
product: Multiple Products
vulnerabilityName: Mozilla Multiple Products Remote Code Execution Vulnerability
dateAdded: 2025-10-06
shortDescription: Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-27
knownRansomwareCampaignUse: Unknown
notes: https://www.mozilla.org/en-US/security/advisories/mfsa2010-73 ; https://nvd.nist.gov/vuln/detail/CVE-2010-3765
cveID: CVE-2025-61882
vendorProject: Oracle
product: E-Business Suite
vulnerabilityName: Oracle E-Business Suite Unspecified Vulnerability
dateAdded: 2025-10-06
shortDescription: Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-27
knownRansomwareCampaignUse: Known
notes: https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61882
cveID: CVE-2014-6278
vendorProject: GNU
product: GNU Bash
vulnerabilityName: GNU Bash OS Command Injection Vulnerability
dateAdded: 2025-10-02
shortDescription: GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. 
dueDate: 2025-10-23
knownRansomwareCampaignUse: Unknown
notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23467 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash ; https://www.ibm.com/support/pages/security-bulletin-update-vulnerabilities-bash-affect-aix-toolbox-linux-applications-cve-2014-6271-cve-2014-6277-cve-2014-6278-cve-2014-7169-cve-2014-7186-and-cve-2014-7187 ; https://nvd.nist.gov/vuln/detail/CVE-2014-6278
cwes: CWE-78
cveID: CVE-2017-1000353
vendorProject: Jenkins
product: Jenkins
vulnerabilityName: Jenkins Remote Code Execution Vulnerability
dateAdded: 2025-10-02
shortDescription: Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-23
knownRansomwareCampaignUse: Unknown
notes: https://www.jenkins.io/security/advisory/2017-04-26/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-1000353
cveID: CVE-2015-7755
vendorProject: Juniper
product: ScreenOS
vulnerabilityName: Juniper ScreenOS Improper Authentication Vulnerability
dateAdded: 2025-10-02
shortDescription: Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-23
knownRansomwareCampaignUse: Unknown
notes: https://supportportal.juniper.net/s/article/2015-12-Out-of-Cycle-Security-Bulletin-ScreenOS-Multiple-Security-issues-with-ScreenOS-CVE-2015-7755-CVE-2015-7756 ; https://nvd.nist.gov/vuln/detail/CVE-2015-7755
cwes: CWE-287
cveID: CVE-2025-21043
vendorProject: Samsung
product: Mobile Devices
vulnerabilityName: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
dateAdded: 2025-10-02
shortDescription: Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-23
knownRansomwareCampaignUse: Unknown
notes: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09 ; https://nvd.nist.gov/vuln/detail/CVE-2025-21043
cwes: CWE-787
cveID: CVE-2025-4008
vendorProject: Smartbedded
product: Meteobridge
vulnerabilityName: Smartbedded Meteobridge Command Injection Vulnerability
dateAdded: 2025-10-02
shortDescription: Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-23
knownRansomwareCampaignUse: Unknown
notes: https://forum.meteohub.de/viewtopic.php?t=18687 ; https://nvd.nist.gov/vuln/detail/CVE-2025-4008
cwes: CWE-306
CWE-77
cveID: CVE-2025-32463
vendorProject: Sudo
product: Sudo
vulnerabilityName: Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
dateAdded: 2025-09-29
shortDescription: Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-20
knownRansomwareCampaignUse: Unknown
notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.sudo.ws/security/advisories/chroot_bug/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-32463
cwes: CWE-829
cveID: CVE-2025-59689
vendorProject: Libraesva
product: Email Security Gateway
vulnerabilityName: Libraesva Email Security Gateway Command Injection Vulnerability
dateAdded: 2025-09-29
shortDescription: Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-20
knownRansomwareCampaignUse: Unknown
notes: https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-59689
cwes: CWE-77
cveID: CVE-2025-10035
vendorProject: Fortra
product: GoAnywhere MFT
vulnerabilityName: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
dateAdded: 2025-09-29
shortDescription: Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-20
knownRansomwareCampaignUse: Known
notes: https://www.fortra.com/security/advisories/product-security/fi-2025-012 ; https://nvd.nist.gov/vuln/detail/CVE-2025-10035
cwes: CWE-502
CWE-77
cveID: CVE-2025-20352
vendorProject: Cisco
product: IOS and IOS XE
vulnerabilityName: Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
dateAdded: 2025-09-29
shortDescription: Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-20
knownRansomwareCampaignUse: Unknown
notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte ; https://nvd.nist.gov/vuln/detail/CVE-2025-20352
cwes: CWE-121
cveID: CVE-2021-21311
vendorProject: Adminer
product: Adminer
vulnerabilityName: Adminer Server-Side Request Forgery Vulnerability
dateAdded: 2025-09-29
shortDescription: Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-20
knownRansomwareCampaignUse: Unknown
notes: https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6 ; https://nvd.nist.gov/vuln/detail/CVE-2021-21311
cwes: CWE-918
cveID: CVE-2025-20362
vendorProject: Cisco
product: Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
vulnerabilityName: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
dateAdded: 2025-09-25
shortDescription: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.
requiredAction: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
dueDate: 2025-09-26
knownRansomwareCampaignUse: Unknown
notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ; https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW ; https://nvd.nist.gov/vuln/detail/CVE-2025-20362
cwes: CWE-862
cveID: CVE-2025-20333
vendorProject: Cisco
product: Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
vulnerabilityName: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
dateAdded: 2025-09-25
shortDescription: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.
requiredAction: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
dueDate: 2025-09-26
knownRansomwareCampaignUse: Unknown
notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ; https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB ; https://nvd.nist.gov/vuln/detail/CVE-2025-20333
cwes: CWE-120
cveID: CVE-2025-10585
vendorProject: Google
product: Chromium V8
vulnerabilityName: Google Chromium V8 Type Confusion Vulnerability
dateAdded: 2025-09-23
shortDescription: Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-14
knownRansomwareCampaignUse: Unknown
notes: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-10585
cwes: CWE-843
cveID: CVE-2025-5086
vendorProject: Dassault Systèmes
product: DELMIA Apriso
vulnerabilityName: Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
dateAdded: 2025-09-11
shortDescription: Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-02
knownRansomwareCampaignUse: Unknown
notes: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-5086 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5086
cwes: CWE-502
cveID: CVE-2025-38352
vendorProject: Linux
product: Kernel
vulnerabilityName: Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability
dateAdded: 2025-09-04
shortDescription: Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-09-25
knownRansomwareCampaignUse: Unknown
notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff ; https://source.android.com/docs/security/bulletin/2025-09-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-38352
cwes: CWE-367
cveID: CVE-2025-48543
vendorProject: Android
product: Runtime
vulnerabilityName: Android Runtime Use-After-Free Vulnerability
dateAdded: 2025-09-04
shortDescription: Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-09-25
knownRansomwareCampaignUse: Unknown
notes: https://source.android.com/docs/security/bulletin/2025-09-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48543
cveID: CVE-2025-53690
vendorProject: Sitecore
product: Multiple Products
vulnerabilityName: Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
dateAdded: 2025-09-04
shortDescription: Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. 
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-09-25
knownRansomwareCampaignUse: Unknown
notes: https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53690
cwes: CWE-502
cveID: CVE-2023-50224
vendorProject: TP-Link
product: TL-WR841N
vulnerabilityName: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
dateAdded: 2025-09-03
shortDescription: TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-09-24
knownRansomwareCampaignUse: Unknown
notes: https://www.tp-link.com/us/support/faq/4308/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-50224
cwes: CWE-290
cveID: CVE-2025-9377
vendorProject: TP-Link
product: Multiple Routers
vulnerabilityName: TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability
dateAdded: 2025-09-03
shortDescription: TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-09-24
knownRansomwareCampaignUse: Unknown
notes: https://www.tp-link.com/us/support/faq/4308/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-9377
cwes: CWE-78
cveID: CVE-2020-24363
vendorProject: TP-Link
product: TL-WA855RE
vulnerabilityName: TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
dateAdded: 2025-09-02
shortDescription: TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-09-23
knownRansomwareCampaignUse: Unknown
notes: https://www.tp-link.com/us/home-networking/range-extender/tl-wa855re/#overview ; https://www.tp-link.com/us/support/download/tl-wa855re/#FAQs ; https://nvd.nist.gov/vuln/detail/CVE-2020-24363
cwes: CWE-306