What is the CVSS score of CVE-2026-1571?

CVE-2026-1571 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Archer C60 Firmware are affected by CVE-2026-1571?

Organizations using User-controlled input should be aware of moderate risk from CVE-2026-1571, a cross-site scripting vulnerability rated CVSS 6.1.

How to fix or mitigate CVE-2026-1571?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Archer C60 Firmware CVE-2026-1571

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-02-11 f23511db-6c3e-4e32-a477-6aa17d310630

TP-Link Archer C60 Firmware

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 01:15 nvd

MEDIUM 6.1

DescriptionCVE.org

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended actions if a privileged user is targeted.

AnalysisAI

Reflected cross-site scripting in TP-Link Archer C60 v3 firmware permits arbitrary JavaScript execution through malicious URLs, enabling attackers to steal credentials or hijack sessions when targeted at privileged users. The vulnerability requires user interaction to trigger but has network-accessible attack vectors with no authentication needed. No patch is currently available.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Archer C60 Firmware. User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended actions if a privileged user is targeted.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.