CVE-2021-3275

Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper validation of the hostname. Some of the pages including dhcp.htm, networkMap.htm, dhcpClient.htm, qsEdit.htm, and qsReview.htm and use this vulnerable hostname function (setDefaultHostname()) without sanitization.

• CWE-79

• http://packetstormsecurity.com/files/161989/TP-Link-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/smriti548/CVE/blob/main/CVE-2021-3275Exploit, Third Party Advisory
• https://seclists.org/fulldisclosure/2021/Mar/67Exploit, Mailing List, Third Party Advisory
• https://www.tp-link.comVendor Advisory
• http://packetstormsecurity.com/files/161989/TP-Link-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/smriti548/CVE/blob/main/CVE-2021-3275Exploit, Third Party Advisory
• https://seclists.org/fulldisclosure/2021/Mar/67Exploit, Mailing List, Third Party Advisory
• https://www.tp-link.comVendor Advisory

Published

Mar 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32744Collabora Online is a collaborative online office suite. In …7.5
• CVE-2021-32745Collabora Online is a collaborative online office suite. A r…6.1
• CVE-2021-32746Icinga Web 2 is an open source monitoring web interface, fra…5.3
• CVE-2021-32747Icinga Web 2 is an open source monitoring web interface, fra…6.5
• CVE-2021-32748Nextcloud Richdocuments in an open source self hosted online…4.3
• CVE-2021-32749fail2ban is a daemon to ban hosts that cause multiple authen…8.1
• CVE-2021-32750MuWire is a file publishing and networking tool that protect…5.7
• CVE-2021-32751Gradle is a build tool with a focus on build automation. In …7.5
• CVE-2021-32752Ether Logs is a package that allows one to check one's logs …4.9
• CVE-2021-32753EdgeX Foundry is an open source project for building a commo…6.5
• CVE-2021-32754FlowDroid is a data flow analysis tool. FlowDroid versions p…5.3
• CVE-2021-32755Wire is a collaboration platform. wire-ios-transport handles…4.3