Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers) Access Points ADSL + DSL Gateways and Routers which affects TD-W9977v1 TL-WA801NDv5 TL-WA801Nv6 TL-WA802Nv5 and Archer C3150v2 devices through the improper validation of the hostname. Some of the pages including dhcp.htm networkMap.htm dhcpClient.htm qsEdit.htm and qsReview.htm and use this vulnerable hostname function (setDefaultHostname()) without sanitization.