CVE-2015-3035: TP-Link router directory traversal allows unauthenticated file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is unauthenticated, remotely reachable, listed in CISA KEV with a very high EPSS score, and public exploit code exists for widely deployed internet-facing routers.

What it is

A path traversal flaw in the web interface of multiple TP-Link Archer and TL-WR/WDR router models lets a remote attacker read arbitrary files by placing a dot-dot sequence in the PATH_INFO of the login/ endpoint. Because the affected devices are internet-facing home and small-office routers, exposed file contents such as configuration and credential data can be pulled without any login.

Impact

An attacker gains read access to arbitrary files on the device, which can expose stored credentials, configuration and other sensitive data. The flaw is read-only; no integrity or availability impact is described.

Attack surface

Reachable over the network through the router's HTTP web interface via a crafted PATH_INFO on login/. The CVSS vector shows no privileges and no user interaction required, so the request can be sent directly to an exposed device.

Exploitation

It is listed in CISA KEV (added 2022-03-25) and has a very high EPSS probability (0.839, ~99.7th percentile), and multiple references are tagged as public exploits, indicating active exploitation and widely available exploit code.

What to do

• Update each affected model to the fixed firmware listed by TP-Link (Archer C5 before 150317, C7 before 150304, C8 before 150316, C9 1.0, TL-WDR3500/3600/4300 before 150302, TL-WR740N/741ND 5.0 before 150312, TL-WR841N/ND 9.0 and 10.0 before 150310).
• If firmware cannot be updated, replace the device or disable remote/administrative web access from untrusted networks.
• Restrict the router management interface to the LAN only and block WAN-side access to the web UI.
• Segment or retire unsupported end-of-life units that will not receive firmware fixes.

Detection

• Monitor HTTP requests to the router web interface for dot-dot sequences in the PATH_INFO of login/ or similar traversal patterns.
• Alert on unexpected outbound or inbound access to router management ports from external addresses.
• Review router logs and network flow data for repeated file-read attempts against the web interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.