PT-2026-7478 · Tp Link · Archer C60

Abdelrahman Khaled · Published 2026-02-11 · Updated 2026-02-11 · CVE-2026-1571

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TP-Link Archer C60 version 3

Description The device allows execution of arbitrary JavaScript code through a crafted URL due to improper encoding of user-controlled input reflected in the HTML output. An attacker could potentially steal credentials, hijack sessions, or perform unintended actions by targeting privileged users within the device's web user interface context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1571

Affected Products

Archer C60

References · 8

• https://tp-link.com/en/support/download/archer-c60/#Firmware · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1571 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1571 · Vendor Advisory
• https://tp-link.com/us/support/faq/4961 · Vendor Advisory
• https://t.me/cveNotify/151654 · Telegram Post
• https://twitter.com/CVEnew/status/2021416338372153355 · Twitter Post
• https://t.me/CVEtracker/44363 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2021408829280276733 · Twitter Post