Statement on Clickjacking vulnerability on the management web application of TP-Link Archer C1200 (CVE-2025-6983)

Important Information:

This device has reached end-of-life (EOL); therefore, please review the ‘Recommendation(s)’ section carefully.

Vulnerability Description:

A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended actions via rendered UI layers or frames.

Impact:

If a user visits a malicious page while logged into the management web application, they may be tricked into interacting with hidden UI elements, potentially leading to unintended actions.

CVSS v4.0 Score: 5.1 / Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendation(s):

We strongly recommended that users with the affected device(s) take the following action(s):

1. Upgrade the device to one of our supported models to be able to receive automatic updates for ongoing protection.

Disclaimer:

If you do not take the recommended action(s) stated above, this vulnerability concern will remain. TP-Link cannot bear any responsibility for the consequences that could have been avoided by following the recommended action(s) in this statement.