Is there a patch available for EUVD-2026-40410?

Yes, a patch is available for EUVD-2026-40410. Update the affected software to the latest version immediately.

TP-Link Archer AX20 EUVD-2026-40410

Q: What is the CVSS score of EUVD-2026-40410?

EUVD-2026-40410 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-10562 MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-06-30 TPLink

GHSA-9f8x-rqfg-wvvg

Path Traversal Open Redirect Archer Ax20 V2 0 Tp Link Systems Inc

5.9

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-accessible, no auth needed, but victim must click crafted link (UI:R); scope changes as redirect crosses to external domain (S:C); no direct availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 21:21 vuln.today

DescriptionCVE.org

An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improper validation of user-supplied URL input within the web interface. An unauthenticated attacker can craft URLs containing URL-encoded path traversal sequences.

When processed by the embedded web server, these inputs may cause the device to respond with HTTP 3xx redirects to attacker-controlled external domains.

This issue affects Archer AX20 V2.0: through 2.1.9 Build 20230829.

AnalysisAI

Open redirect in the TP-Link Archer AX20 V2 embedded web server allows unauthenticated attackers to craft URLs containing URL-encoded path traversal sequences that cause the device to issue HTTP 3xx redirects toward attacker-controlled external domains. All firmware versions through 2.1.9 Build 20230829 on the V2.0 hardware revision are confirmed affected per TP-Link's own advisory and CPE data. No public exploit identified at time of analysis, and a vendor-released patch is available; active exploitation has not been confirmed by CISA KEV.

Technical ContextAI

The Archer AX20 V2 is a consumer-grade Wi-Fi 6 (802.11ax) router whose management plane is exposed via an embedded HTTP server on the LAN-facing (and potentially WAN-accessible) web interface. CWE-601 (URL Redirection to Untrusted Site, commonly called Open Redirect) describes the root cause: the embedded server accepts user-supplied URL input without sanitizing or allowlisting the destination host before emitting HTTP Location headers. The tags confirm URL-encoded path traversal sequences (e.g., %2E%2E%2F) are the delivery mechanism, exploiting the fact that the URL decoder normalizes encoded characters before the redirect decision is made - a classic double-decode or improper validation pattern. The affected CPE is cpe:2.3:a:tp-link_systems_inc.:archer_ax20_v2.0:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade the Archer AX20 V2.0 firmware to a version released after 2.1.9 Build 20230829, available from the TP-Link official download page at https://www.tp-link.com/en/support/download/archer-ax20/v2/#Firmware. The exact patched build number is not independently confirmed beyond 'patch available per vendor advisory' - verify the changelog on the download page before deploying. While awaiting patching, a compensating control is to disable remote web management (WAN-side access to the admin interface) in the router's Advanced settings, which prevents unauthenticated external attackers from reaching the vulnerable web server; note this does not protect against LAN-side attackers or phishing scenarios targeting local users. Restricting LAN-side access to the admin interface by MAC address or VLAN segmentation further reduces the attack surface but adds operational complexity. Advise users not to click unsolicited links that appear to point to their router's IP address or hostname.