This vulnerability (CWE-601) affects TP-Link Archer AX20 V2.0 routers through version 2.1.9 Build 20230829. An unauthenticated attacker can exploit improper validation of URL parameters in the embedded web server to cause HTTP 3xx redirects to arbitrary external sites. The attack involves crafting URLs with URL-encoded path traversal sequences that bypass input validation. The vulnerability does not require privileges or authentication and can be triggered via user interaction with malicious URLs.

Successful exploitation can lead to users being redirected to attacker-controlled websites, potentially facilitating phishing attacks or other social engineering exploits. The vulnerability itself does not allow direct device compromise but may be used as part of a broader attack chain. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by TP-Link as of the information available. Users should monitor TP-Link advisories for firmware updates addressing this issue. Until a fix is available, caution is advised when interacting with unexpected or suspicious URLs referencing the device's web interface.