CVE-2015-3035

HighActively exploited (CISA KEV)

Description

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.

SeverityHigh

CVSS7.5

Exploit probability—

Product

TP-Link Multiple Archer Devices

PublishedApr 22, 2015

First seenApr 22, 2015

Added to KEVMar 25, 2022

Weakness typeCWE-22Path traversal

How to fix

CISA required action

Apply updates per vendor instructions.

CISA due date: Apr 15, 2022

Update

tp-link tl-wr741nd_firmware150312 or later
tp-link tl-wr841n_firmware150310 or later
tp-link tl-wr740n_firmware150312 or later
tp-link archer_c5_firmware150317 or later
tp-link tl-wdr3600_firmware150302 or later
tp-link archer_c7_firmware150304 or later
tp-link tl-wr841nd_firmware150310 or later
tp-link archer_c9_firmware150302 or later
tp-link archer_c8_firmware150316 or later
tp-link tl-wdr4300_firmware150302 or later
tp-link tl-wdr3500_firmware150302 or later

Affected products

Product	Affected versions	Fixed in
tp-link tl-wr741nd_firmware	v < 150312	150312
tp-link tl-wr841n_firmware	v < 150310	150310
tp-link tl-wr740n_firmware	v < 150312	150312
tp-link archer_c5_firmware	v < 150317	150317
tp-link tl-wdr3600_firmware	v < 150302	150302
tp-link archer_c7_firmware	v < 150304	150304
tp-link tl-wr841nd_firmware	v < 150310	150310
tp-link archer_c9_firmware	v < 150302	150302
tp-link archer_c8_firmware	v < 150316	150316
tp-link tl-wdr4300_firmware	v < 150302	150302
tp-link tl-wdr3500_firmware	v < 150302	150302

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.