TP-Link Archer C60 V3 Reflected Cross-Site Scripting Vulnerability Allowing Arbitrary JavaScript Execution

A reflected cross-site scripting vulnerability has been identified in the TP-Link Archer C60 V3 router. This issue arises because user-controlled input is not properly encoded before being output in the HTML, allowing for the execution of arbitrary JavaScript. An attacker could exploit this by sending a crafted URL that, when clicked, executes the script in the context of the device's web user interface. This could lead to credential theft, session hijacking, or unauthorized actions, particularly if a privileged user is targeted.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute JavaScript in the context of the user's session on the device's web interface.

Remediation

Users are advised to update to the latest firmware version. The latest firmware can be downloaded from the TP-Link official website.