CVE-2015-3035
CVE-2015-3035 is a security flaw in TP-Link Multiple Archer Devices, routers for homes and small offices. Attackers can read files on TP-Link Multiple Archer Devices that should be out of reach. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of flaws known to be used in attacks on 25 Mar 2022.[1]
TP-Link Multiple Archer Devices is in things households have: home and small-office routers, so the fix matters at home as much as at work.
Description
CISA calls it a directory traversal in TP-Link Multiple Archer Devices. In its words: “Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.”[1]
The CVE record adds: “Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.”[2]
The underlying weakness is path traversal (CWE-22), in MITRE’s list of common software weaknesses.
It scores 7.5 out of 10 on the Common Vulnerability Scoring System, which rates it high, scored by NVD using CVSS 3.1.[2]
Affected versions
NVD’s record doesn’t list version ranges for it. CISA names the product as TP-Link Multiple Archer Devices.
Every device with TP-Link Multiple Archer Devices needs the update.
Exploitation
CISA added it to its catalog of known exploited vulnerabilities on 25 Mar 2022, 2,529 days after it was made public. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 15 Apr 2022 to fix it.[1]
FIRST’s Exploit Prediction Scoring System, which estimates how likely a flaw is to be used in attacks in the next 30 days from what it sees across the internet, puts it at 84%. That’s in the top 1% of the flaws it scores.[3]
CISA assesses it as automatable: attackers can run it against many targets at once.
CISA doesn’t say who was attacked, or how.
Fix
CISA’s required action: “Apply updates per vendor instructions.”[1]
- Update TP-Link Multiple Archer Devices now.Open the router’s app, or its admin page in a browser, and look for a firmware update. Then turn on automatic updates, so the next fix arrives on its own.
- If the maker has stopped updating it, replace it.Routers stop getting fixes after a few years, and attackers keep a list of the ones that did. If there’s no newer firmware, it won’t be fixed.
Timeline
| Date | Event |
|---|---|
| The flaw is made public in the National Vulnerability Database, with a severity score of 7.5.[2] | |
| CISA adds it to its catalog of flaws known to be used in attacks.[1] | |
| CISA’s deadline for US government agencies to fix it.[1] | |
| FIRST puts the odds of it being used in attacks in the next 30 days at 84%.[3] |
See also
Other TP-Link flaws
- CVE-2025-9377, TP-Link Multiple Routers: archer C7(EU) and TL-WR841N/ND(MS) OS command injection ·
- CVE-2023-50224, TP-Link TL-WR841N: authentication bypass by spoofing ·
- CVE-2020-24363, TP-Link TL-WA855RE: missing authentication for critical function ·
- CVE-2023-33538, TP-Link Multiple Routers: command injection ·
- CVE-2023-1389, TP-Link Archer AX21: archer AX-21 command injection ·
Other path traversal flaws
- CVE-2025-61624, Fortinet products: path traversal ·
- CVE-2021-3199, ONLYOFFICE Docs: server path traversal ·
- CVE-2026-104286, Fortinet FortiMail: path traversal ·
- CVE-2026-93616, Check Point products: path traversal ·
- CVE-2026-66384, JFrog Artifactory: improper limitation of a pathname to a restricted directory ·
Added the same day
- CVE-2022-26318, WatchGuard Firebox and XTM Appliances: arbitrary code execution ·
- CVE-2022-26143, Mitel MiCollab, MiVoice Business Express: access control ·
- CVE-2022-21999, Microsoft Windows: print spooler privilege escalation ·
- CVE-2021-42237, Sitecore XP: remote command execution ·
- CVE-2021-22941, Citrix ShareFile: improper access control ·
Every TP-Link flaw on CISA’s list · Everything added in March 2022
References
- ^ Cybersecurity and Infrastructure Security Agency. “TP-Link Multiple Archer Devices Directory Traversal Vulnerability”. Known Exploited Vulnerabilities Catalog, added 25 Mar 2022.
- ^ National Institute of Standards and Technology. “CVE-2015-3035 Detail”. National Vulnerability Database, published 22 Apr 2015.
- ^ FIRST. “Exploit Prediction Scoring System”. EPSS 0.839, percentile 99.7, 31 Oct 2026.
- CVE Program. “CVE-2015-3035”. The official CVE record.
This article is built from CISA’s catalog (version 2026.10.30), NVD’s record and FIRST’s scores, kept in HARD’s database and checked every morning. The plain English is HARD’s.