Unvalidated response execution enables MitM JavaScript execution in TP-Link Archer and TL-WR routers

The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router's admin web portal without the user's permission or knowledge.

• Archer MR200 v5.20: affected through <= 1.1.0 Build 240723 Rel. 52455n. TP-Link lists 1.2.0 Build 250917 Rel.51746 as the fixed version.
• Archer C20 v5: affected through <= V5_241231. TP-Link lists the regional fixed versions as US_V5_260419 and EU_V5_260317.
• Archer C20 v6: affected through <= 0.9.1 4.19 v0001.0 Build 241231 Rel.53022n. The fixed version is 0.9.1 4.19 v0001.0 Build 250630 Rel.56583n.
• TL-WR850N v3: affected through <= 3.16.0 0.9.1 Build 230227. The fixed version is 3.16.0 0.9.1 v6031.0 Build 251205 Rel.22089n.
• TL-WR845N v4: affected through <= 0.9.1 3.19 Build 250401 rel57442. The fixed version is 0.9.1 3.19 Build 251031 rel33710.

TP-Link identifies Archer C20 v5 as EOL and states that the other listed models are not sold in the United States. The status of branches or variants not separately listed in the advisory should not be inferred from the fix for another branch.

TP-Link states that the response returned by the router for any request is executed directly by a JavaScript function such as eval without validation. In a Man-in-the-Middle (MitM) scenario, the attacker-controlled response delivered to the administration web portal can cause unintended JavaScript execution. The supplied vector describes adjacent-network reachability, no privileges required on the router, and passive user interaction. The affected component is the JavaScript response-handling logic in the management interface; the record does not identify the endpoint, response format, exact call site, or detailed transport assumptions. The weakness is classified as CWE-95, improper neutralization of directives in dynamically evaluated code.

The vulnerability is reachable from an adjacent network through a MitM attack that affects traffic used by the router's administration portal. The supplied record characterizes the attack as requiring no prior privileges, while requiring an attacker-controlled MitM position and passive user interaction. The user does not need to knowingly approve the script because TP-Link describes execution in the administration portal without the user's permission or knowledge. The supplied record marks public_exploit as false and known_exploited as null; the evidence reviewed does not identify a campaign, victim, IOC, or exploit code. This status does not establish that future exploitation is impossible.

Successful exploitation causes JavaScript to execute in the browser context of the router's administration web portal. This may expose information accessible to the management session and may allow influence over administrative actions or settings presented by the interface. TP-Link identifies a potential password leakage risk, but the evidence does not establish a specific configuration action, code execution on the router operating system, or propagation to other systems. Because the attack requires an adjacent-network MitM position and passive user interaction, the practical scope depends on the network path that can be controlled and the capabilities available to the affected management session. Organisational consequences may include loss of confidentiality for administrative data, unauthorized configuration changes, and router service disruption, although the specific outcome depends on the executed code and session access.

• JavaScript execution in the administration portal may expose information rendered to the affected management session, including sensitive router configuration data.
• An attacker may influence administrative actions available to that session, but the evidence does not establish a specific setting change or complete router takeover.
• TP-Link warns of potential password leakage and recommends changing the password after the firmware upgrade.
• Practical impact depends on whether the attacker can obtain a MitM position on the adjacent network and whether a user reaches the administration portal under the affected conditions.
• TP-Link identifies Archer C20 v5 as EOL and states that the other listed models are not sold in the United States, making asset identification and regional update availability operationally important.

1. Upgrade firmware for the exact model, hardware revision, and region. Update Archer MR200 v5.20 to 1.2.0 Build 250917 Rel.51746.
2. Update Archer C20 v5 to the applicable regional firmware: US_V5_260419 or EU_V5_260317.
3. Update Archer C20 v6 to 0.9.1 4.19 v0001.0 Build 250630 Rel.56583n, TL-WR850N v3 to 3.16.0 0.9.1 v6031.0 Build 251205 Rel.22089n, and TL-WR845N v4 to 0.9.1 3.19 Build 251031 rel33710.
4. Change the administration password after the firmware upgrade to reduce the potential risk associated with the password leakage concern identified by TP-Link.
5. Verify the model, region, and installed firmware after updating. Do not use a fix for one product or firmware branch to conclude that another product or branch is unaffected. If the corresponding firmware cannot be deployed, the evidence does not provide a validated workaround; contact TP-Link to determine appropriate support or replacement options.

1. Inventory deployed devices and identify the exact model and hardware revision, especially Archer MR200, Archer C20, TL-WR850N, and TL-WR845N.
2. Read the installed firmware on each device and compare it with the affected boundaries and corresponding fixed versions listed in affected_summary and remediation.
3. For Archer C20 v5, verify the applicable regional firmware because TP-Link publishes separate US and EU fixes.
4. After updating, recheck the installed firmware and change the administration password as recommended by TP-Link.
5. Where data is available, review router administration logs and network telemetry for unexpected administrative activity or configuration changes. This is precautionary monitoring only; TP-Link does not provide a specific IOC or log signature, and the absence of such evidence does not prove that a device is safe.