Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2015-3035

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0)

Published
Last modified
published
Listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub

Summary

The vulnerability affects TP-LINK Archer C5, C7, C8, and C9 routers, several TL-WDR series routers, and certain TL-WR740N, TL-WR741ND, and TL-WR841N/ND models. It allows remote attackers to read arbitrary files stored on the affected device, which could expose sensitive configuration data.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • n/a n/a

    Version range not reported

References 16

tp-link.com

packetstormsecurity.com

seclists.org

securityfocus.com

sec-consult.com