Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update new UI) allows attackers to execute arbitrary JavaScript by modifying the \User Name\ field or \Password\ field.