CVE-2018-3949: TP-Link TL-R600VPN HTTP server path traversal file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable file disclosure with a high EPSS score and public exploit references, though it is not known to be exploited in the wild per KEV.

What it is

The HTTP server in the TP-Link TL-R600VPN router is vulnerable to directory traversal via a specially crafted URL, allowing sensitive system files to be read. The flaw is reachable over the network without authentication, so any host that can reach the device's web interface can attempt it.

Impact

An attacker gains read access to sensitive files on the device, which can expose configuration data, credentials or other system information useful for follow-on attacks. There is no integrity or availability impact; the loss is confidentiality only.

Attack surface

Reached over the network through the device's HTTP server using a crafted URL; the CVSS vector shows no privileges and no user interaction required, and the description states the request can be unauthenticated or authenticated.

Exploitation

Not listed in CISA KEV, but EPSS is high (about 53% 30-day probability, 98.9th percentile) and both references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor firmware update for the TL-R600VPN that fixes the traversal; if no fixed firmware is available, replace or retire the device.
• Do not expose the router's web management interface to the internet; restrict access to a trusted management network or VPN.
• Disable remote management and any WAN-side HTTP/HTTPS administration features.
• Segment the device so that compromise cannot be used to pivot into other network segments.
• Monitor vendor advisories for this product line and track end-of-support status.

Detection

• Inspect HTTP request logs or IDS/IPS signatures for traversal sequences such as ../ or encoded variants in URLs directed at the router's web interface.
• Alert on unexpected outbound connections or file-read activity originating from the router itself.
• Watch for repeated requests to unusual paths on the management interface from a single source.
• Review router configuration and logs for signs of unauthorized access or changed settings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.