PT-2015-3445 · Tp Link · Tp-Link Archer C7+10

Stefan Viehböck · Published 2015-04-17 · Updated 2025-10-22 · CVE-2015-3035

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions TP-LINK Archer C5 versions 1.2 with firmware before 150317 TP-LINK Archer C7 version 2.0 with firmware before 150304 TP-LINK Archer C8 version 1.0 with firmware before 150316 TP-LINK Archer C9 version 1.0 TP-LINK TL-WDR3500 version 1.0 with firmware before 150302 TP-LINK TL-WDR3600 version 1.0 with firmware before 150302 TP-LINK TL-WDR4300 version 1.0 with firmware before 150302 TP-LINK TL-WR740N version 5.0 with firmware before 150312 TP-LINK TL-WR741ND version 5.0 with firmware before 150312 TP-LINK TL-WR841N versions 9.0 through 10.0 with firmware before 150310 TP-LINK TL-WR841ND versions 9.0 through 10.0 with firmware before 150310

Description The issue is related to a directory traversal vulnerability that allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH INFO to "login/". This can be exploited to bypass authentication procedures and read or write arbitrary files in the system. The vulnerability is due to incorrect restriction of the path name to a directory with limited access.

Recommendations For TP-LINK Archer C5 version 1.2, update the firmware to version 150317 or later. For TP-LINK Archer C7 version 2.0, update the firmware to version 150304 or later. For TP-LINK Archer C8 version 1.0, update the firmware to version 150316 or later. For TP-LINK Archer C9 version 1.0, update the firmware to a version that addresses the issue. For TP-LINK TL-WDR3500 version 1.0, update the firmware to version 150302 or later. For TP-LINK TL-WDR3600 version 1.0, update the firmware to version 150302 or later. For TP-LINK TL-WDR4300 version 1.0, update the firmware to version 150302 or later. For TP-LINK TL-WR740N version 5.0, update the firmware to version 150312 or later. For TP-LINK TL-WR741ND version 5.0, update the firmware to version 150312 or later. For TP-LINK TL-WR841N versions 9.0 through 10.0, update the firmware to version 150310 or later. For TP-LINK TL-WR841ND versions 9.0 through 10.0, update the firmware to version 150310 or later. As a temporary workaround, consider restricting access to the "login/" endpoint until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-01039

CVE-2015-3035

Affected Products

Tp-Link Archer C5

Tp-Link Archer C7

Tp-Link Archer C8

Tp-Link Archer C9

Tp-Link Tl-Wdr3500

Tp-Link Tl-Wdr3600

Tp-Link Tl-Wdr4300

Tp-Link Tl-Wr740N

Tp-Link Tl-Wr741N

Tp-Link Tl-Wr841N

Tp-Link Tl-Wr841Nd

References · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/archer_c7_traversal.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/tplink_archer_c7_traversal.rb · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Apr/26 · Exploit
• 🔥 https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html · Exploit
• https://bdu.fstec.ru/vul/2023-01039 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-3035 · Security Note
• http://tp-link.com/en/download/TL-WDR3500_V1.html#Firmware · Note
• https://t.me/cveNotify/139777 · Telegram Post
• http://tp-link.com/en/download/TL-WR740N_V5.html#Firmware · Note
• http://tp-link.com/en/download/TL-WDR4300_V1.html#Firmware · Note
• https://t.me/cvenotify/117665 · Telegram Post
• http://securityfocus.com/archive/1/535240/100/0/threaded · Note
• https://t.me/cvenotify/110002 · Telegram Post
• http://tp-link.com/en/download/TL-WR841N_V9.html#Firmware · Note