CVE-2015-3035

Description

Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.

References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2015-3035
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3116
• http://www.tp-link.com/en/download/Archer-C9_V1.html#Firmware
• http://www.tp-link.com/en/download/Archer-C7_V2.html#Firmware
• http://www.tp-link.com/en/download/TL-WR740N_V5.html#Firmware
• http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware
• http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html
• http://www.tp-link.com/en/download/TL-WR841N_V9.html#Firmware
• http://www.tp-link.com/en/download/TL-WR841ND_V9.html#Firmware
• http://seclists.org/fulldisclosure/2015/Apr/26
• http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware
• http://www.tp-link.com/en/download/TL-WDR3500_V1.html#Firmware
• http://www.securityfocus.com/bid/74050
• https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt
• http://www.tp-link.com/en/download/TL-WR741ND_V5.html#Firmware
• http://www.tp-link.com/en/download/Archer-C8_V1.html#Firmware
• http://www.tp-link.com/en/download/TL-WDR4300_V1.html#Firmware
• http://www.securityfocus.com/archive/1/535240/100/0/threaded