{"id":"CVE-2015-3035","kind":"vulnerability","aliases":["CVE-2015-3035"],"related":[],"title":"TP-Link Multiple Archer Devices: TP-Link Multiple Archer Devices Directory Traversal Vulnerability","description":"Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.","summary":"Multiple TP-Link Archer router models have a directory traversal flaw in the web login handler. A remote attacker can use '..' in the PATH_INFO of a request to login/ and read arbitrary files from the device.","severity":"high","cvss":7.8,"epss":0.83948,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"TP-Link Multiple Archer Devices","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["archer","exploited","home-router","infrastructure","self-hosted","tp-link"],"not_affected_if":["admin-interface-not-exposed","non-archer-models"],"how_to_check":"Check the router model and firmware version in the admin UI under System Tools or the device label; compare against the vendor advisory listed in the sources. unknown for a command-line check.","fix":"Apply the firmware update from TP-Link for your Archer model, per CISA's required action. Restrict admin interface access to the local network if an update is not available.","status":"open","published_at":"2015-04-22T01:59:02+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:21:46+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:21:46Z","model":"claude-haiku-5-5","output":{"fix":"Apply the firmware update from TP-Link for your Archer model, per CISA's required action. Restrict admin interface access to the local network if an update is not available.","reach":"internet","impact":"medium","summary":"Multiple TP-Link Archer router models have a directory traversal flaw in the web login handler. A remote attacker can use '..' in the PATH_INFO of a request to login/ and read arbitrary files from the device.","category":"infrastructure","who_cares":["tp-link","archer","self-hosted","home-router"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads arbitrary files from the router, including configuration and credentials.","analyst_note":"Affected model list and fixed firmware versions are not in the sources; check the TP-Link security advisory and the CISA KEV entry for the exact models.","how_to_check":"Check the router model and firmware version in the admin UI under System Tools or the device label; compare against the vendor advisory listed in the sources. unknown for a command-line check.","needs_analyst":true,"not_affected_if":["non-archer-models","admin-interface-not-exposed"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000496,"input_tokens":2861,"output_tokens":420,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2015':17A,20A '-3035':18A,21A '1.0':100C,107C,111C,115C,120C '1.2':87C '10.0':146C,155C '150302':124C '150304':97C '150310':159C '150312':137C '150316':104C '150317':91C '2.0':93C '5.0':128C,133C '9.0':142C,150C 'allow':160C 'arbitrari':73B,165C 'archer':5A,11A,26A,28B,44B,85C,105C 'attack':59B,162C 'c5':86C 'c7':92C 'c8':99C 'c9':106C 'cve':16A,19A 'devic':6A,12A,77B 'devices':27A 'directori':13A,49B,78C 'dot':169C,170C 'exploit':29B 'file':74B,166C 'firmwar':89C,95C,102C,122C,135C,157C 'flaw':51B 'handler':56B 'home':31B 'home-rout':30B 'host':36B 'info':65B,174C 'infrastructur':33B 'link':3A,9A,24A,39B,43B,84C 'login':55B,70B,176C 'model':46B 'multipl':4A,10A,40B 'multiple':25A 'path':64B,173C 'read':72B,164C 'remot':58B,161C 'request':68B 'router':32B,45B 'self':35B 'self-host':34B 'tl':109C,113C,118C,126C,131C,140C,144C,148C,153C 'tl-wdr3500':108C 'tl-wdr3600':112C 'tl-wdr4300':117C 'tl-wr740n':125C 'tl-wr741nd':130C 'tl-wr841n':139C,143C 'tl-wr841nd':147C,152C 'tp':2A,8A,23A,38B,42B,83C 'tp-link':1A,7A,22A,37B,41B,82C 'travers':14A,50B,79C 'use':61B 'via':167C 'vulner':15A,80C 'wdr3500':110C 'wdr3600':114C 'wdr4300':119C 'web':54B 'wr740n':127C 'wr741nd':132C 'wr841n':141C,145C 'wr841nd':149C,154C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-04-22T01:59:02+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-3035","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3035","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:48+00:00","note":null},{"source":"epss","external_id":"CVE-2015-3035","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-3035","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2015-3035","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3035","severity":null,"published_at":"2015-04-22T01:59:02+00:00","modified_at":"2026-06-17T00:25:09+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}