CVE-2026-10562CWE-601

Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface

Medium · published June 30, 2026

CVSS v4.0
5.9
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

An

unauthenticated URL redirection vulnerability has been identified in Archer

AX20 V2 due to improper validation of user-supplied URL input within the web

interface.  An unauthenticated attacker

can craft URLs containing URL-encoded path traversal sequences.

When

processed by the embedded web server, these inputs may cause the device to

respond with HTTP 3xx redirects to attacker-controlled external domains.

This issue affects Archer AX20 V2.0: through 2.1.9 Build 20230829.

The record
Technical detail
CVSS v4.0
5.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00459 · 38.8th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-06-30T20:34Z
EPSS history
Timeline
  • 30 JUN 20:34Z
    Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface
    cvelistv5