An unauthenticated open redirect vulnerability (CWE-601) exists in TP-Link Archer AX20 V2.0 routers due to insufficient validation of user-supplied URLs in the embedded web server interface. Attackers can craft URLs containing URL-encoded path traversal sequences that cause the device to respond with HTTP 3xx redirects to external domains controlled by the attacker. This affects firmware versions from 2.0.0 up to and including 2.1.9 Build 20230829. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation allows an unauthenticated attacker to redirect users of the device's web interface to arbitrary external websites. This could facilitate phishing or other social engineering attacks by leveraging the trusted device interface to redirect victims to malicious sites. The vulnerability does not require authentication but does require user interaction with a crafted URL. There is no indication of direct device compromise or data leakage from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious or unsolicited URLs that reference the device's web interface. Network administrators may consider restricting access to the device's management interface to trusted networks or users to reduce exposure.