An attacker can send a specially crafted request that the router processes and executes as JavaScript, because the firmware evaluates the payload with eval without sanitization. This flaw, classified as CWE‑95, enables arbitrary code to run on the router’s admin interface, allowing the attacker to modify configuration, hijack traffic, or exfiltrate information. The impact is remote code execution within the router’s administrative web portal, exposing the device to full control.

Affected devices include TP‑Link Archer MR200 firmware 5.2, TP‑Link Archer C20 firmware 5 and 6, TP‑Link TL‑WR850N firmware 3, and TP‑Link TL‑WR845N firmware 4; firmware updates are available at the vendor sites linked in the references. Devices running newer firmware versions are not reported to be vulnerable.

The CVSS score of 5.9 rates the issue as moderate, and an EPSS score below 1% indicates a very low probability of exploitation at present. The vulnerability is not included in the CISA KEV catalog. Exploitation requires an attacker to act as a Man‑in‑the‑Middle on the local network, injecting malicious JavaScript into the router’s admin response; if successful, it results in remote code execution that could alter router settings or redirect traffic.