CVE-2026-10562

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10562", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-06-01T15:52:40.939Z", "datePublished": "2026-06-30T20:34:43.577Z", "dateUpdated": "2026-07-01T15:38:52.064Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-06-30T20:34:43.577Z"}, "title": "Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-601", "description": "CWE-601 URL redirection to untrusted site ('open redirect')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-194", "descriptions": [{"lang": "en", "value": "CAPEC-194 Fake the Source of Data"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Archer AX20 V2.0", "modules": ["web"], "versions": [{"status": "affected", "version": "0", "lessThan": "V2_260527", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An\nunauthenticated URL redirection vulnerability has been identified in Archer\nAX20 V2 due to improper validation of user-supplied URL input within the web\ninterface.\u00a0 An unauthenticated attacker\ncan craft URLs containing URL-encoded path traversal sequences.\n\n\n\n\n\nWhen\nprocessed by the embedded web server, these inputs may cause the device to\nrespond with HTTP 3xx redirects to attacker-controlled external domains.\n\n\n\nThis issue affects Archer AX20 V2.0: through 2.1.9 Build 20230829.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><p>An\nunauthenticated URL redirection vulnerability has been identified in Archer\nAX20 V2 due to improper validation of user-supplied URL input within the web\ninterface.&nbsp; An unauthenticated attacker\ncan craft URLs containing URL-encoded path traversal sequences.</p>\n\n<p>When\nprocessed by the embedded web server, these inputs may cause the device to\nrespond with HTTP 3xx redirects to attacker-controlled external domains.</p><p>This issue affects Archer AX20 V2.0: through 2.1.9 Build 20230829.</p></div>"}]}], "references": [{"url": "https://www.tp-link.com/en/support/download/archer-ax20/v2/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/faq/5156/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "VeyselXan (Cyb3rLynx)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T15:38:41.789160Z", "id": "CVE-2026-10562", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T15:38:52.064Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10562", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T15:38:41.789160Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T15:38:48.582Z"}}], "cna": {"title": "Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "VeyselXan (Cyb3rLynx)"}], "impacts": [{"capecId": "CAPEC-194", "descriptions": [{"lang": "en", "value": "CAPEC-194 Fake the Source of Data"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "modules": ["web"], "product": "Archer AX20 V2.0", "versions": [{"status": "affected", "version": "0", "lessThan": "V2_260527", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/en/support/download/archer-ax20/v2/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/faq/5156/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "An\nunauthenticated URL redirection vulnerability has been identified in Archer\nAX20 V2 due to improper validation of user-supplied URL input within the web\ninterface.\u00a0 An unauthenticated attacker\ncan craft URLs containing URL-encoded path traversal sequences.\n\n\n\n\n\nWhen\nprocessed by the embedded web server, these inputs may cause the device to\nrespond with HTTP 3xx redirects to attacker-controlled external domains.\n\n\n\nThis issue affects Archer AX20 V2.0: through 2.1.9 Build 20230829.", "supportingMedia": [{"type": "text/html", "value": "<div><p>An\nunauthenticated URL redirection vulnerability has been identified in Archer\nAX20 V2 due to improper validation of user-supplied URL input within the web\ninterface.&nbsp; An unauthenticated attacker\ncan craft URLs containing URL-encoded path traversal sequences.</p>\n\n<p>When\nprocessed by the embedded web server, these inputs may cause the device to\nrespond with HTTP 3xx redirects to attacker-controlled external domains.</p><p>This issue affects Archer AX20 V2.0: through 2.1.9 Build 20230829.</p></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL redirection to untrusted site ('open redirect')"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-06-30T20:34:43.577Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10562", "state": "PUBLISHED", "dateUpdated": "2026-07-01T15:38:52.064Z", "dateReserved": "2026-06-01T15:52:40.939Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-06-30T20:34:43.577Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["web"], "product": "Archer AX20 V2.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "V2_260527", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An\nunauthenticated URL redirection vulnerability has been identified in Archer\nAX20 V2 due to improper validation of user-supplied URL input within the web\ninterface.\u00a0 An unauthenticated attacker\ncan craft URLs containing URL-encoded path traversal sequences.\n\n\n\n\n\nWhen\nprocessed by the embedded web server, these inputs may cause the device to\nrespond with HTTP 3xx redirects to attacker-controlled external domains.\n\n\n\nThis issue affects Archer AX20 V2.0: through 2.1.9 Build 20230829."}, {"lang": "es", "value": "Una vulnerabilidad de redirecci\u00f3n de URL no autenticada ha sido identificada en Archer AX20 V2 debido a una validaci\u00f3n incorrecta de la entrada de URL proporcionada por el usuario dentro de la interfaz web. Un atacante no autenticado puede crear URL que contienen secuencias de salto de ruta codificadas en URL.\n\nCuando son procesadas por el servidor web integrado, estas entradas pueden hacer que el dispositivo responda con redirecciones HTTP 3xx a dominios externos controlados por el atacante.\n\nEste problema afecta a Archer AX20 V2.0: hasta 2.1.9 Build 20230829."}], "id": "CVE-2026-10562", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10562", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-01T15:38:41.789160Z", "version": "2.0.3"}}]}, "published": "2026-06-30T21:16:30.260", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/archer-ax20/v2/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/faq/5156/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,V2_260527)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer AX20 V2.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_ax20", "vendor": "tp-link"}], "created": "2026-06-30T22:30:06.270844+00:00", "updated": "2026-07-01T10:01:05.640381+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$archer_ax20"]}