Which versions of TP-Link Archer C5 are affected by CVE-2026-8699?

TP-Link Archer C5 v6.8 routers in ISP-managed firmware variants contain a stored cross-site scripting vulnerability that enables session hijacking and unauthorized configuration modification when…. A patch is available.

How to fix or mitigate CVE-2026-8699?

24 hours: Audit and catalog all TP-Link Archer C5 v6.8 devices in infrastructure; implement firewall rules restricting web management interface access to trusted administrative networks only; review all active administrator accounts for suspicious activity. 7 days: Enable comprehensive logging for all administrative actions and configuration changes; segment router management traffic from customer-facing networks using separate VLANs; disable any unnecessary services accessible from the web management interface. 30 days: Confirm patch timeline with TP-Link for firmware v6.8.x release; develop migration plan to alternative routers with active vendor security support; document risk acceptance and implementation status of compensating controls for any devices remaining unpatched.

TP-Link Archer C5 CVE-2026-8699

Q: What is the CVSS score of CVE-2026-8699?

CVE-2026-8699 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41407 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 f23511db-6c3e-4e32-a477-6aa17d310630

GHSA-2rgg-wpwx-p48p

XSS Authentication Bypass Information Disclosure

7.0

CVSS 4.0 · Vendor: f23511db-6c3e-4e32-a477-6aa17d310630

Severity by source

Vendor (f23511db-6c3e-4e32-a477-6aa17d310630) PRIMARY

7.0 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Adjacent management interface (AV:A) and existing admin access (PR:H) are required, a second admin must view the page (UI:R), and stored script crossing into the victim's session yields scope change with high confidentiality/integrity but no availability impact.

3.1 AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (f23511db-6c3e-4e32-a477-6aa17d310630).

CVSS VectorVendor: f23511db-6c3e-4e32-a477-6aa17d310630

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 02, 2026 - 18:01 EUVD

Analysis Generated

Jul 02, 2026 - 17:30 vuln.today

DescriptionCVE.org

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient server-side validation and lack of proper output encoding of user-controlled input in a certain field. An attacker with administrative privileges can inject crafted HTML or JS payloads into the affected field. The payload is stored and later executed when the affected page is rendered in an administrator's browser.Successful exploitation allows execution of arbitrary JavaScript in an admin's browser, potentially leading to session hijacking and unauthorized access to router configuration, possibly resulting in exposure of sensitive data and modification of device settings.

The vulnerability affects ISP-managed firmware variants of the product. Remediation is coordinated through service providers.

AnalysisAI

Stored cross-site scripting in the TP-Link Archer C5 v6.8 router web management interface lets an authenticated administrator inject persistent HTML/JavaScript into a user-controlled field that later executes in another administrator's browser session. The flaw affects ISP-managed firmware variants and can be leveraged for session hijacking and unauthorized modification of router configuration. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires existing admin access, sharply limiting real-world impact.

Technical ContextAI

The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS in the embedded web administration UI of the Archer C5, a consumer/ISP-provisioned wireless router. The root cause is insufficient server-side input validation combined with a lack of output encoding when a user-controlled field is rendered back into an admin HTML page, allowing attacker-supplied markup to be interpreted as executable script rather than inert text. Because the affected builds are ISP-managed firmware variants, the vulnerable code path and remediation are controlled by service providers rather than end users. No CPE strings were supplied in the intelligence, so the exact affected build identifiers cannot be enumerated beyond the stated Archer C5 v6.8 ISP-managed firmware.

RemediationAI

No vendor-released patch version was identified in the available data; the only reference is a TP-Link support FAQ (https://www.tp-link.com/en/support/faq/5165/) and the description states remediation is coordinated through the service provider, so affected users should contact their ISP to confirm and obtain the corrected ISP-managed firmware. As compensating controls until fixed firmware is deployed: restrict access to the router's web management interface to trusted management VLANs or specific hosts and disable any remote/WAN-side management (reduces the adjacent-network reach the AV:A vector depends on, at the cost of admin convenience); enforce strong, unique administrator credentials and avoid sharing admin accounts (limits the PR:H precondition, though it does not remove risk from an already-compromised admin); and where the interface supports it, avoid having a second administrator browse configuration pages that may contain untrusted stored input. Each control narrows a specific exploitation prerequisite rather than eliminating the flaw.