CVE-2015-3035: TP-Link Multiple Archer Devices Directory Traversal Vulnerability
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATHINFO to login/.
Other sources
Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATHINFO to login/.
— CISA
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3035?
CVE-2015-3035 has been classified with a high severity rating due to its potential to allow directory traversal attacks.
How do I fix CVE-2015-3035?
To mitigate CVE-2015-3035, update the firmware of affected TP-Link devices to the latest version that resolves this vulnerability.
What devices are affected by CVE-2015-3035?
CVE-2015-3035 impacts several TP-Link Archer and TL-WR devices with specific firmware versions prior to the recommended updates.
Can CVE-2015-3035 be exploited remotely?
Yes, CVE-2015-3035 can be exploited remotely by an attacker with knowledge of the vulnerability and proper techniques.
What are the potential impacts of CVE-2015-3035?
Exploitation of CVE-2015-3035 can lead to unauthorized access to sensitive files on the affected TP-Link devices.