CVE-2015-3035
7.5 · HIGH Actively ExploitedOverview
CVE-2015-3035 is a high-severity vulnerability affecting tp-link tl-wr741nd_firmware. It was published on April 22, 2015 and has a CVSS 3.1 base score of 7.5 (HIGH). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
This vulnerability has a CVSS 3.1 base score of 7.5, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical Description
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
Remediation
Check the references section for vendor advisories and patches from tp-link. Update tl-wr741nd_firmware to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected Products
| Vendor | Product | Versions | Status |
|---|---|---|---|
| tp-link | tl-wr741nd_firmware | >= 0, < 150312 | Affected |
| tp-link | tl-wr841n_firmware | >= 0, < 150310 | Affected |
| tp-link | tl-wr740n_firmware | >= 0, < 150312 | Affected |
| tp-link | archer_c5_firmware | >= 0, < 150317 | Affected |
| tp-link | tl-wdr3600_firmware | >= 0, < 150302 | Affected |
| tp-link | archer_c7_firmware | >= 0, < 150304 | Affected |
| tp-link | tl-wr841nd_firmware | >= 0, < 150310 | Affected |
| tp-link | archer_c9_firmware | >= 0, < 150302 | Affected |
| tp-link | archer_c8_firmware | >= 0, < 150316 | Affected |
| tp-link | tl-wdr4300_firmware | >= 0, < 150302 | Affected |
References
Frequently Asked Questions
What is CVE-2015-3035?
CVE-2015-3035 is a high-severity vulnerability affecting tp-link tl-wr741nd_firmware. It was published on April 22, 2015 and has a CVSS 3.1 base score of 7.5 (HIGH). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
How severe is CVE-2015-3035?
This vulnerability has a CVSS 3.1 base score of 7.5, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2015-3035?
Check the references section for vendor advisories and patches from tp-link. Update tl-wr741nd_firmware to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2015-3035?
CyberStrike's AI-powered security agents can automatically detect CVE-2015-3035 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.
How CyberStrike Helps
AI agents map your attack surface to find vulnerabilities like this one.
Automated penetration testing that runs continuously, not just quarterly.
AI-driven PR review catches vulnerable dependencies before they ship.
Browser-based exploitation validates findings with real proof-of-concept.
Related HIGH CVEs from 2015
View all →Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before
Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x b
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote att
Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a cr
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista
JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial o
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista S
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS befo
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause