Unauthenticated URL Redirection in TP-Link Archer AX20

Executive Summary

This vulnerability is an unauthenticated URL redirection issue found in Archer AX20 V2 devices. It occurs because the device's web interface does not properly validate user-supplied URL inputs. An attacker can create specially crafted URLs containing URL-encoded path traversal sequences that, when processed by the device's embedded web server, cause the device to redirect users to attacker-controlled external websites.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an unauthenticated attacker to redirect users of the Archer AX20 V2 device to malicious external websites. This can lead to phishing attacks, malware distribution, or other malicious activities by tricking users into visiting harmful sites. Since the attacker does not need to be authenticated, it increases the risk of exploitation.

Useful 0 Not Useful 0