On TP‑Link Archer C60 v3, a user‑controlled query string is reflected into the web UI’s HTML output without proper encoding, allowing an attacker to inject and execute arbitrary JavaScript when a privileged user is logged into the router. This could enable credential theft, session hijacking, or the execution of unintended commands as the device user.

The affected equipment is the TP‑Link Archer C60 version 3, running firmware 3.0. No other vendors or product lines are listed as impacted.

The vulnerability has a CVSS score of 5.3, indicating medium severity, and an EPSS score of less than 1 %, showing a low likelihood of exploitation. It is not catalogued in CISA’s KEV list. The attack vector would typically involve an attacker crafting a malicious URL and convincing a privileged user to visit it while authenticated to the router’s web interface.