peter bassill · operator
$ cve CVE-2015-3035 JSON

CVE-2015-3035 KEV

7.5
HIGH · CVSS 3.1 · EPSS 83.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-04-15.

Description

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.

Scoring

CVSS7.5 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS83.95% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-22
On CISA KEVyes — remediate by 2022-04-15
Public exploitnone known
Published2015-04-22
Last modified2026-06-17

CISA KEV

NameTP-Link Multiple Archer Devices Directory Traversal Vulnerability
Added2022-03-25
Due2022-04-15
Vendor / productTP-Link / Multiple Archer Devices
Ransomware usenone reported

Affected (22)

VendorProduct
tp-linkarcher c5
tp-linkarcher c5 firmware
tp-linkarcher c7
tp-linkarcher c7 firmware
tp-linkarcher c8
tp-linkarcher c8 firmware
tp-linkarcher c9
tp-linkarcher c9 firmware
tp-linktl-wdr3500
tp-linktl-wdr3500 firmware
tp-linktl-wdr3600
tp-linktl-wdr3600 firmware
tp-linktl-wdr4300
tp-linktl-wdr4300 firmware
tp-linktl-wr740n
tp-linktl-wr740n firmware
tp-linktl-wr741nd
tp-linktl-wr741nd firmware
tp-linktl-wr841n
tp-linktl-wr841n firmware
tp-linktl-wr841nd
tp-linktl-wr841nd firmware

References

→ the Explorer  ·  watch your stack  ·  NVD