CVE-2024-57514: XSS
First published: Tue Jan 28 2025(Updated: )
The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL. This allows the attacker to inject malicious code into the page, executing JavaScript on the victim's browser, which could then be used for further malicious actions. The vulnerability was identified in the 1.0.6 Build 20231011 rel.85717(5553) version.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TP-Link Archer |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-57514?
CVE-2024-57514 has a medium severity rating due to the potential for Cross-site Scripting (XSS) attacks.
How do I fix CVE-2024-57514?
To fix CVE-2024-57514, update the firmware of the TP-Link Archer A20 v3 router to the latest version provided by TP-Link.
What does CVE-2024-57514 affect?
CVE-2024-57514 specifically affects the TP-Link Archer A20 v3 router due to improper handling of directory listing paths.
What is the impact of CVE-2024-57514?
The impact of CVE-2024-57514 allows attackers to execute arbitrary JavaScript in the context of the user's browser when accessing a malicious URL.
How can I prevent exploitation of CVE-2024-57514?
To prevent exploitation of CVE-2024-57514, avoid clicking on suspicious URLs and ensure that your router's firmware is kept updated.
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/softwarecombine
- agent/author
- agent/source
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/tp-link
- canonical/tp-link archer