TI-2026-01260 Aliases CVE-2026-1571 GHSA-5vrw-6f4h-227q

Reflected XSS Vulnerability on TP-Link Archer C60

LOW 24CWE-79Published 2026-02-11 · Updated 2026-03-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended actions if a privileged user is targeted.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00325 25th percentileScored 2026-11-07

Fix Fixed Archer C60 v3 (TP-Link Systems Inc.): V3_260206

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TP-Link	Archer C60 v3	before V3_260206	V3_260206	Patch available	CNA

Archer C60 v3 VendorTP-Link Affected before V3_260206 Fixed in V3_260206 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:tp-link:archer_c60_firmware::::::::	before 260206	Vulnerable	TP-Link
cpe:2.3:h:tp-link:archer_c60:3.0:::::::*	3.0	Running on	TP-Link

cpe:2.3:o:tp-link:archer_c60_firmware:*:*:*:*:*:*:*:* Versions before 260206 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:archer_c60:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·TP-Link

Remediation

Fix · CNA Archer C60 v3 (TP-Link Systems Inc.) Fixed in V3_260206

Timeline

2026-10-02 Threatist record created from CVE-2026-1571
2026-10-03 Alias added: GHSA-5vrw-6f4h-227q

References

Patch 1

https://www.tp-link.com/en/support/download/archer-c60/#Firmware

Advisory 1

https://www.tp-link.com/us/support/faq/4961/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences