CVE-2026-10562: Archer AX20 V2 URL Redirection Vulnerability

CVE-2026-10562 Overview

CVE-2026-10562 is an unauthenticated URL redirection vulnerability in the TP-Link Archer AX20 V2 router. The flaw resides in the embedded web interface, which fails to properly validate user-supplied URL input. An attacker can craft URLs containing URL-encoded path traversal sequences that the embedded web server processes as legitimate redirect targets. When triggered, the device responds with HTTP 3xx redirects pointing to attacker-controlled external domains. The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site, also known as Open Redirect).

Critical Impact
An unauthenticated remote attacker can weaponize the router's trusted domain to redirect victims to phishing pages, malware payloads, or credential harvesting sites without any authentication or prior access.

Affected Products

TP-Link Archer AX20 V2.0 (firmware versions through 2.1.9 Build 20230829)
Embedded web interface component of the router
Devices running vulnerable firmware releases prior to the vendor patch

Discovery Timeline

2026-06-30 - CVE-2026-10562 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-10562

Vulnerability Analysis

The Archer AX20 V2 web management interface accepts URL parameters that influence HTTP redirect responses. The embedded web server does not properly sanitize or validate these parameters before including them in the Location header of HTTP 3xx responses. Attackers can supply URL-encoded path traversal sequences to bypass any origin-checking logic present in the firmware. Because the endpoint requires no authentication, exploitation only requires a victim to click a maliciously crafted link pointing to the router.

Root Cause

The underlying defect is improper input validation on user-supplied URL data within the router's web interface. The redirect handler trusts URL-encoded input without canonicalizing the value or enforcing an allowlist of permitted redirect destinations. Path traversal sequences such as encoded slashes and dot segments defeat naive prefix checks that would otherwise restrict redirects to the local device.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker distributes a crafted link that appears to point to a trusted router management URL through phishing emails, malicious advertisements, or compromised websites. When the victim clicks the link, the router responds with an HTTP redirect to the attacker's domain. This technique is commonly abused for phishing, session token theft via referrer leakage, and delivery of malicious payloads under the guise of a trusted network device. The vulnerability primarily impacts confidentiality by facilitating credential theft and social engineering attacks against users who trust the router's hostname or IP.

No verified public exploit code or proof-of-concept has been published. See the TP-Link Archer AX20 Firmware page and the TP-Link FAQ on Support for vendor guidance.

Detection Methods for CVE-2026-10562

Indicators of Compromise

HTTP 3xx responses from the router containing Location headers pointing to external, non-local domains
Inbound requests to the Archer AX20 V2 web interface containing URL-encoded traversal sequences such as %2F, %2E%2E, or %5C in query parameters
Client browsers logging redirects that originate from the router's LAN IP and terminate at unfamiliar external hosts
Phishing campaigns referencing the router's management URL in embedded links

Detection Strategies

Inspect HTTP traffic to and from the router web interface for anomalous redirect chains that leave the local network segment
Deploy URL filtering rules that flag requests to the router containing encoded path traversal patterns
Correlate outbound DNS queries from client devices with recent HTTP redirects sourced from the router's IP address
Review router access logs, where available, for unusual query string patterns targeting redirect endpoints

Monitoring Recommendations

Enable network-level logging of HTTP traffic on the LAN segment hosting the Archer AX20 V2
Alert on any HTTP 302 or 307 response from the router referencing a non-RFC1918 destination in the Location header
Track user-reported phishing attempts that reference internal management URLs

How to Mitigate CVE-2026-10562

Immediate Actions Required

Update Archer AX20 V2 firmware to the latest release available from the TP-Link support portal
Restrict access to the router's web management interface to trusted internal hosts and disable remote management if enabled
Educate users on recognizing suspicious links, especially those referencing internal router addresses
Audit browsers and email clients for any bookmarked or recently clicked links pointing to the router's management URL with unusual query parameters

Patch Information

TP-Link addresses firmware defects through the Archer AX20 V2 firmware download page. Administrators should download and apply the most recent firmware release beyond 2.1.9 Build 20230829 and verify installation through the router's status page. Consult the TP-Link FAQ on Support for firmware upgrade procedures.

Workarounds

Disable the router's web administration interface when not actively required for configuration
Block outbound HTTP redirects from the router's IP at the perimeter firewall or DNS resolver using policy filtering
Segment the management VLAN so only administrator workstations can reach the router web interface

bash

# Example: Restrict router web interface access via an upstream firewall rule
# Only allow the admin workstation (192.0.2.10) to reach the router (192.0.2.1) on TCP/80 and TCP/443
iptables -A FORWARD -s 192.0.2.10 -d 192.0.2.1 -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.1 -p tcp -m multiport --dports 80,443 -j DROP