Live › vulnerability › CVE-2015-3035
Go to dashboardMultiple TP-Link Archer router models have a directory traversal flaw in the web login handler. A remote attacker can use '..' in the PATH_INFO of a request to login/ and read arbitrary files from the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| TP-Link Multiple Archer Devices | vendor | – | – |
Check the router model and firmware version in the admin UI under System Tools or the device label; compare against the vendor advisory listed in the sources. unknown for a command-line check.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
This page as .md · .json · in your agent: get_signal("CVE-2015-3035")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.