CVE-2026-1571 in Archer C60 v3
Summary
by MITRE • 02/11/2026
User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended actions if a privileged user is targeted.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/21/2026
The vulnerability identified as CVE-2026-1571 represents a critical cross-site scripting flaw within the TP-Link Archer C60 v3 wireless router firmware. This issue stems from insufficient input validation and output encoding mechanisms that fail to properly sanitize user-supplied data before incorporating it into HTML responses. The vulnerability specifically affects the web-based management interface of the device, which serves as the primary attack surface for remote exploitation.
The technical implementation of this flaw occurs when the router's web server processes user-controllable parameters and directly reflects them into HTML output without appropriate HTML entity encoding or sanitization. This creates an environment where maliciously crafted URLs can inject arbitrary JavaScript code into the browser context of any user who accesses the compromised page. The vulnerability is classified as a classic reflected cross-site scripting vulnerability, which aligns with CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and follows the ATT&CK technique T1059.007 - Command and Scripting Interpreter: JavaScript.
The operational impact of this vulnerability extends beyond simple script execution capabilities. An attacker who successfully exploits this flaw can execute malicious JavaScript code within the context of the router's web interface, potentially enabling credential theft through session cookie harvesting, session hijacking attacks, or manipulation of administrative functions. The risk is particularly elevated when privileged users access the compromised interface, as the executed code would operate with the same privileges as the authenticated user. This could allow attackers to modify router configurations, create new administrator accounts, or establish persistent access to the network infrastructure.
Mitigation strategies for this vulnerability should include immediate firmware updates from TP-Link to address the reflected XSS implementation flaw. Network administrators should also implement additional security controls such as web application firewalls that can detect and block malicious script injection attempts, restrict access to the router's management interface through network segmentation, and employ multi-factor authentication for administrative access. The vulnerability demonstrates the critical importance of input validation and output encoding in web applications, as outlined in OWASP Top 10 2021 category A03: Injection, and represents a fundamental security principle that should be applied to all web-based interfaces in network infrastructure devices.