Security Check-in Quick Hits: TP-Link Exploits, WhatsApp Spyware, Android Zero-Days, and NotDoor Malware Threats

For September 4, 2025

Urgent Alert: TP-Link Wi-Fi Extenders Under Active Exploitation – What You Need to Know

In today's rapidly evolving cybersecurity landscape, vulnerabilities in everyday networking devices can pose significant risks to both individuals and organizations. One of the hottest topics buzzing on X today is the addition of a critical flaw in TP-Link Wi-Fi range extenders to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog. This development highlights how outdated hardware can become a gateway for attackers, emphasizing the need for proactive device management.

The vulnerability in question, CVE-2020-24363, is a high-severity missing authentication issue rated at 8.8 out of 10. It affects the TP-Link TL-WA855RE Wi-Fi Range Extender, allowing unauthorized attackers to gain elevated access to the device without proper credentials. This flaw has been confirmed as actively exploited in the wild, making it a pressing concern for anyone using these extenders to boost their home or office Wi-Fi signals. The potential impacts are severe: attackers could hijack the device, reset configurations, or use it as a pivot point to infiltrate broader networks, compromising sensitive data or enabling further attacks like man-in-the-middle interceptions.

What makes this particularly alarming is the end-of-life status of the affected model. TP-Link has released a firmware fix available on their support site, but since the device is no longer supported, no additional updates will be forthcoming. This leaves users in a bind – patching might provide temporary relief, but long-term security requires upgrading to a newer, supported model. Federal agencies are mandated under CISA's Binding Operational Directive (BOD) 22-01 to address this flaw immediately, and CISA recommends that all users, including private individuals and businesses, prioritize mitigation to avoid exploitation.

To protect yourself, start by checking if your extender is the TL-WA855RE model and apply any available firmware updates. Consider segmenting your network to isolate IoT devices like extenders from critical systems. Regularly monitoring for unusual network activity and using strong, unique passwords can also help. In an era where supply-chain attacks and device hijacks are on the rise, this incident serves as a stark reminder that even seemingly minor hardware can be a major vulnerability.

Staying informed and acting swiftly is key to maintaining robust cybersecurity. If you're using TP-Link devices, now's the time to review and upgrade – your network's integrity depends on it.

WhatsApp Users Targeted: Spyware Flaw Exploited in High-Profile Campaigns

As messaging apps become integral to daily communication, their security flaws can have far-reaching implications for user privacy. Dominating discussions on X today is a vulnerability in WhatsApp that's been added to CISA's KEV catalog, linked to targeted spyware attacks. This issue underscores the growing threat of sophisticated espionage tools that exploit popular platforms.

Identified as CVE-2025-55177, this flaw is an incomplete authorization vulnerability rated at 5.4 in severity. It affects WhatsApp for iOS (versions before 2.25.21.73), WhatsApp Business for iOS (before 2.25.21.78), and WhatsApp for Mac (before 2.25.21.78). The bug involves improper handling of messages synced across linked devices, allowing unauthorized access in certain scenarios. It's been exploited in combination with CVE-2025-43300, a separate flaw in Apple's iOS, iPadOS, and macOS, as part of a highly targeted spyware campaign.

Evidence points to active exploitation affecting fewer than 200 users, with WhatsApp issuing in-app warnings to those potentially impacted. The impacts are primarily on privacy: attackers could access synced messages, leading to data leaks or further compromise of personal information. This is especially concerning for high-profile individuals, journalists, or activists who might be targets of state-sponsored surveillance.

Mitigation is straightforward – update to the latest versions of WhatsApp and associated Apple operating systems immediately. CISA urges federal agencies to comply with BOD 22-01 by patching promptly, and the advice extends to all users: enable automatic updates and be cautious with linked devices. Additional best practices include using end-to-end encryption features fully and avoiding suspicious links or attachments that could initiate such attacks.

This flaw highlights the intersection of app vulnerabilities and ecosystem dependencies, like those with Apple devices. As spyware evolves, users must remain vigilant. Regularly reviewing app permissions and staying updated can significantly reduce risks, ensuring that your conversations stay private in an increasingly connected world.

Android Zero-Days Under Attack: Google's Latest Patches and How to Stay Safe

Mobile security remains a battleground, with Android devices facing constant threats from sophisticated exploits. A major talking point on X today revolves around Google's September 2025 security bulletin, which patches two actively exploited zero-day vulnerabilities. This update is crucial for billions of Android users worldwide, addressing flaws that could lead to unauthorized control of devices.

The zero-days are CVE-2025-38352, affecting the Android Runtime component and linked to upstream kernel issues, and CVE-2025-48543, impacting the System component. Both are rated High in severity and classified as Elevation of Privilege (EoP) vulnerabilities, potentially allowing attackers to escalate privileges without user interaction. They are under limited, targeted exploitation, meaning specific users or devices are being hit in focused attacks.

Affected versions include Android 13, 14, 15, and 16 for CVE-2025-48543, with broader implications across recent releases. The potential impacts are dire: successful exploitation could enable remote code execution or full system compromise, exposing personal data, apps, and hardware features to attackers.

Google has rolled out patches via the security patch level 2025-09-05 or later, with source code to be released to the Android Open Source Project (AOSP) within 48 hours. Android partners were notified in advance, adhering to responsible disclosure. Users should update immediately through their device settings, and enabling Google Play Protect adds an extra layer of monitoring.

To defend against these threats, keep your device on the latest OS version, avoid sideloading apps, and use reputable sources only. This incident reflects the ongoing cat-and-mouse game in mobile security – staying patched is your best defense against evolving exploits.

NotDoor Backdoor: Russian APT28's Latest Tool Targeting Outlook for Data Theft

State-sponsored cyber threats continue to sophisticate, with email clients like Outlook becoming prime targets for espionage. Surfacing prominently on X today is the NotDoor malware, a backdoor linked to Russia's APT28 group, designed to stealthily exfiltrate data from compromised systems.

NotDoor, attributed to Fancy Bear (APT28), is a VBA-based malware that embeds in Microsoft Outlook. It activates via event triggers like Application_MAPILogonComplete (on Outlook startup) and Application_NewMailEx (on new email arrival), scanning for keywords like "Daily Report" to execute commands. Infection occurs through DLL side-loading, using a legitimate signed binary (OneDrive.exe) to load malicious code, and by modifying registry keys to disable macro security warnings.

Once inside, it creates hidden directories for temporary files, exfiltrates data to an attacker-controlled email (a.matti444@proton[.]me), and sends callbacks to confirm execution. Goals include file uploads, command execution, and data theft, with persistence ensured through silent operation.

Indicators of compromise include the exfiltration email, registry modifications, and hidden folders. Defenses: Disable macros by default, monitor Outlook for anomalies, and secure email systems against similar threats.

APT28's history with high-profile breaches makes NotDoor a serious concern. Organizations should implement macro restrictions and regular audits to counter such advanced persistent threats, safeguarding sensitive communications.