Is CVE-2015-3035 exploited in the wild?

Yes. CVE-2015-3035 is known to be exploited in the wild, first recorded on 25 March 2022. Treat it as urgent.

How severe is CVE-2015-3035?

Critical severity, with a CVSS score of 7.5, published 25 March 2022.

Which products and versions are affected?

TP-LINK Archer C5 (1.2) firmware before 150317; TP-LINK Archer C7 (2.0) firmware before 150304; TP-LINK Archer C8 (1.0) firmware before 150316; TP-LINK Archer C9 (1.0) firmware before 150302; and 7 more.

Is there a fix for CVE-2015-3035?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2015-3035 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2015-3035?

Check whether you run TP-Link Archer or TP-Link Multiple Archer Devices. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-3035: TP-Link Multiple Archer Devices Directory Traversal Vulnerability

CVE-2015-3035 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2022-03-25

A directory traversal vulnerability in multiple TP-Link Archer and TL-series routers allows remote unauthenticated attackers to read arbitrary files. The flaw exists due to improper handling of dot-dot (..) sequences in the PATH_INFO parameter sent to the login/ endpoint.

Vendors: TP-Link.

Quick answers

Is CVE-2015-3035 exploited in the wild?: Yes. CVE-2015-3035 is known to be exploited in the wild, first recorded on 25 March 2022. Treat it as urgent.
How severe is CVE-2015-3035?: Critical severity, with a CVSS score of 7.5, published 25 March 2022.
Which products and versions are affected?: TP-LINK Archer C5 (1.2) firmware before 150317; TP-LINK Archer C7 (2.0) firmware before 150304; TP-LINK Archer C8 (1.0) firmware before 150316; TP-LINK Archer C9 (1.0) firmware before 150302; and 7 more.
Is there a fix for CVE-2015-3035?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2015-3035 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2015-3035?: Check whether you run TP-Link Archer or TP-Link Multiple Archer Devices. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

TP-LINK Archer C5 (1.2) firmware before 150317
TP-LINK Archer C7 (2.0) firmware before 150304
TP-LINK Archer C8 (1.0) firmware before 150316
TP-LINK Archer C9 (1.0) firmware before 150302
TP-LINK TL-WDR3500 (1.0) firmware before 150302
TP-LINK TL-WDR3600 (1.0) firmware before 150302
TP-LINK TL-WDR4300 (1.0) firmware before 150302
TP-LINK TL-WR740N (5.0) firmware before 150312
TP-LINK TL-WR741ND (5.0) firmware before 150312
TP-LINK TL-WR841N (9.0/10.0) firmware before 150310
TP-LINK TL-WR841ND (9.0/10.0) firmware before 150310

Timeline

2015-04-10: disclosed: Original advisory by SEC Consult
2022-03-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.