CVE-2026-1571
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in TP-Link Archer C60 v3 routers where user input is reflected in HTML output without proper encoding. Attackers can craft malicious URLs to execute arbitrary JavaScript in the device's web interface context, potentially compromising router administration sessions. Users of TP-Link Archer C60 v3 routers with vulnerable firmware are affected.
💻 Affected Systems
- TP-Link Archer C60 v3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal administrator credentials, hijack active sessions, change router configuration, or redirect users to malicious sites, potentially gaining full control of the router.
Likely Case
Attackers could steal session cookies or credentials when administrators visit crafted URLs, enabling unauthorized access to router settings.
If Mitigated
With proper input validation and output encoding, the vulnerability would be prevented, and impact would be limited to unsuccessful exploitation attempts.
🎯 Exploit Status
Exploitation requires the victim to visit a crafted URL while authenticated to the router's web interface. No authentication is needed to craft the malicious URL.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check TP-Link support site for latest firmware
Vendor Advisory: https://www.tp-link.com/en/support/download/archer-c60/#Firmware
Restart Required: Yes
Instructions:
1. Visit TP-Link Archer C60 v3 firmware download page. 2. Download latest firmware for your hardware version. 3. Log into router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Wait for router to reboot.
🔧 Temporary Workarounds
Disable Remote Management
allPrevents external access to router web interface
Use Browser Security Extensions
allInstall XSS protection browser extensions like NoScript
🧯 If You Can't Patch
- Restrict access to router web interface to trusted networks only
- Implement network segmentation to isolate router management interface
🔍 How to Verify
Check if Vulnerable:
Check current firmware version in router web interface under System Tools > Firmware UpgradeCheck Version:
No CLI command - check via web interface at 192.168.0.1 or 192.168.1.1Verify Fix Applied:
Verify firmware version matches latest available from TP-Link support site📡 Detection & Monitoring
Log Indicators:
- Unusual URL parameters in web interface access logs
- Multiple failed login attempts followed by successful login
Network Indicators:
- HTTP requests with suspicious JavaScript in URL parameters to router IP
SIEM Query:
source="router_logs" AND (url="*<script>*" OR url="*javascript:*")