The response coming from TP-Link Archer MR200 v5.2, C20 v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router's admin web portal without the user's permission or knowledge.
2026-02-05T18:16:09.593
2026-02-12T16:24:44.087
Analyzed
f23511db-6c3e-4e32-a477-6aa17d310630
CVSSv3.1: 5.6 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Operating System | tp-link | archer_mr200_firmware | < 250917 | Yes |
| Hardware | tp-link | archer_mr200 | 5.20 | No |
| Operating System | tp-link | archer_c20_firmware | < 250630 | Yes |
| Hardware | tp-link | archer_c20 | 6 | No |
| Operating System | tp-link | tl-wr850n_firmware | < 0.9.1_Build251205 | Yes |
| Hardware | tp-link | tl-wr850n | 3 | No |
| Operating System | tp-link | tl-wr845n_firmware | < 251031 | Yes |
| Hardware | tp-link | tl-wr845n | 4 | No |