TP-LINK is a prominent brand in the field of networking products. The company offers a range of routers and modems that are widely popular among businesses and individuals alike. These devices are designed to provide high speed and reliable internet connectivity to their users. TP-LINK's Archer C5 (1.2), Archer C7 (2.0), Archer C8 (1.0), Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), TL-WDR4300 (1.0), TL-WR740N (5.0), TL-WR741ND (5.0), TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) are some of their popular offerings.
One of these devices, the TP-LINK Archer C5 (1.2), Archer C7 (2.0), Archer C8 (1.0), Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), TL-WDR4300 (1.0), TL-WR740N (5.0), TL-WR741ND (5.0), TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) has been found to have a severe vulnerability. This vulnerability is known as CVE-2015-3035 and is related to directory traversal. The vulnerability exists in the firmware of these devices before versions 150317, 150304, 150316, 150302, and 150312, respectively.
Exploiting this vulnerability, a remote attacker can potentially read arbitrary files on the device by adding a ".." (dot dot) to the end of the URL before the "login/" keyword. This can result in the attacker gaining access to sensitive information, such as login credentials. The attacker can also use this access to execute arbitrary code on the device, leading to further damage.
It is important to note that vulnerability scanning and management platforms like s4e.io provide comprehensive and easy-to-use solutions that can help businesses and individuals protect their digital assets from vulnerabilities such as CVE-2015-3035. With the help of such platforms, the users can quickly identify and mitigate vulnerabilities in their devices and networks, providing them with peace of mind and a strong foothold against cyber attacks.
REFERENCES
- http://www.tp-link.com/en/download/Archer-C9_V1.html#Firmware
- http://www.tp-link.com/en/download/Archer-C7_V2.html#Firmware
- http://www.tp-link.com/en/download/TL-WR740N_V5.html#Firmware
- http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware
- http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html
- http://www.tp-link.com/en/download/TL-WR841N_V9.html#Firmware
- http://www.tp-link.com/en/download/TL-WR841ND_V9.html#Firmware
- seclists.org: 20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)
- http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware
- http://www.tp-link.com/en/download/TL-WDR3500_V1.html#Firmware
- securityfocus.com: 74050
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt
- http://www.tp-link.com/en/download/TL-WR741ND_V5.html#Firmware
- http://www.tp-link.com/en/download/Archer-C8_V1.html#Firmware
- http://www.tp-link.com/en/download/TL-WDR4300_V1.html#Firmware
- securityfocus.com: 20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)
To protect against this vulnerability, users of TP-LINK Archer C5 (1.2), Archer C7 (2.0), Archer C8 (1.0), Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), TL-WDR4300 (1.0), TL-WR740N (5.0), TL-WR741ND (5.0), TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) devices can take the following precautions:
- Update the device firmware to the latest version.
- Disable remote access to the device.
- Change the default login credentials of the device to a strong, unique password.
- Enable multi-factor authentication, if available.
- Use a VPN to access the device remotely.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →