An unauthenticated open‑redirect flaw exists in the Archer AX20 V2 web interface due to inadequate validation of user‑supplied URLs. An attacker may craft a request containing a URL‑encoded path traversal sequence that causes the router to issue an HTTP 3xx redirect to a domain chosen by the attacker. This can lead to phishing or malicious site visits by users who interact with the router’s interface, compromising the confidentiality of exposed credentials or enabling session hijacking. The weakness is a classic CWE‑601 flaw that permits redirection to arbitrary external resources.

The vulnerability affects TP‑Link Archer AX20 devices running firmware version V2.0 through V2.1.9 Build 20230829. Only the identified firmware range is impacted; newer releases after this build are not known to be affected.

The CVSS score of 5.9 indicates a moderate severity. No EPSS information is available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. The attack requires an unauthenticated user to trigger the redirect, typically by clicking a manipulated link; thus, the probability of accidental exploitation is low but the impact on users who do click is real. Network operators should treat this as a moderate risk that could be mitigated by patching or access controls.