EIP-2026-102058

PRE-CVE

TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting (Unauthenticated)

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-102058. PoCs published by Smriti Gaba.

AI-analyzed exploit summary This is a detailed technical writeup describing an unauthenticated stored XSS vulnerability in multiple TP-Link devices. The vulnerability arises from improper validation of the hostname parameter in functions like setDefaultHostname(), allowing malicious scripts to execute when displayed in various web interface pages.

Description

TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting (Unauthenticated)

Exploits (1)

exploitdb WRITEUP
by Smriti Gaba · textwebappshardware
https://www.exploit-db.com/exploits/49720

This is a detailed technical writeup describing an unauthenticated stored XSS vulnerability in multiple TP-Link devices. The vulnerability arises from improper validation of the hostname parameter in functions like setDefaultHostname(), allowing malicious scripts to execute when displayed in various web interface pages.

Classification
Writeup 95%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: TP-Link devices (multiple models and firmware versions)
No auth needed
Prerequisites: Access to a wireless client connected to the TP-Link device · Ability to modify the hostname of the wireless client
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026