CVE-2015-3035
HighExploitedPublic exploitDirectory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302,…
Published Apr 21, 2015 · Updated Apr 21, 2026
Key Facts
Patch immediately- CVE-2015-3035 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Archer C5 Firmware (Tp-Link), Archer C7 Firmware (Tp-Link), Archer C8 Firmware (Tp-Link) and 8 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 25, 2022. Public exploit code is available.
- EPSS estimates a 84% probability of exploitation in the next 30 days.
- Fixed versions are available, including Archer C5 Firmware 150317, Archer C7 Firmware 150304, Archer C8 Firmware 150316.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
84%
Higher than 99.6% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2015-3035 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| Industry KEV feed | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| CIRCL KEV | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| ENISA EUVD | Mar 25, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
11 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Archer C5 FirmwareTp-Link | See advisory | 150317 |
| Archer C7 FirmwareTp-Link | See advisory | 150304 |
| Archer C8 FirmwareTp-Link | See advisory | 150316 |
| Archer C9 FirmwareTp-Link | See advisory | 150302 |
| Tl-Wdr3500 FirmwareTp-Link | See advisory | 150302 |
Patched Releases
Archer C5 Firmware
150317
Archer C7 Firmware
150304
Archer C8 Firmware
150316
Archer C9 Firmware
150302
Tl-Wdr3500 Firmware
150302
Tl-Wdr3600 Firmware
150302
Tl-Wdr4300 Firmware
150302
Tl-Wr740n Firmware
150312
Tl-Wr741nd Firmware
150312
Tl-Wr841n Firmware
150310
Tl-Wr841nd Firmware
150310
Timeline
Publicly disclosed
Apr 21, 2015
Added to CISA KEV
Mar 25, 2022
Added to Industry KEV feed
Mar 25, 2022
Added to CIRCL KEV
Mar 25, 2022
Added to ENISA EUVD
Mar 25, 2022
Last updated
Apr 21, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- advisory20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)
- advisory74050
- exploithttp://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html
- exploit20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)
- exploitVulnCheck exploitation report
FAQ
Common Questions.
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firm…
Affected: Archer C5 Firmware (Tp-Link); Archer C7 Firmware (Tp-Link); Archer C8 Firmware (Tp-Link), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 25, 2022.
Yes. It was added on Mar 25, 2022 with a federal remediation due date of Apr 15, 2022.
Public exploit code is available.
Fixed versions are available, including Archer C5 Firmware 150317, Archer C7 Firmware 150304, Archer C8 Firmware 150316.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2015-3035 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo