CVE-2026-8699: Stored Cross-Site Scripting (XSS) in TP-Link Archer C5 Web Management Interface
A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient server-side validation and lack of proper output encoding of user-controlled input in a certain field. An attacker with administrative privileges can inject crafted HTML or JS payloads into the affected field. The payload is stored and later executed when the affected page is rendered in an administrator's browser.Successful exploitation allows execution of arbitrary JavaScript in an admin's browser, potentially leading to session hijacking and unauthorized access to router configuration, possibly resulting in exposure of sensitive data and modification of device settings.
The vulnerability affects ISP-managed firmware variants of the product. Remediation is coordinated through service providers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8699?
The severity of CVE-2026-8699 is high, with a CVSS score of 7.
What type of vulnerability is CVE-2026-8699?
CVE-2026-8699 is a Stored Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-8699?
To fix CVE-2026-8699, ensure to update the TP-Link Archer C5 firmware to the latest version that addresses this vulnerability.
What devices are affected by CVE-2026-8699?
CVE-2026-8699 affects TP-Link Archer C5 routers, specifically version 6.8.
What can attackers do with CVE-2026-8699?
Attackers with administrative privileges can exploit CVE-2026-8699 to execute malicious scripts in the context of an authenticated user's session.