TP-LINK Multiple Router Models Directory Traversal Arbitrary File Disclosure (CVE-2015-3035) Technical Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2015-3035) is a directory traversal flaw in the built-in web server of multiple TP-LINK router models. The root cause lies in the insufficient validation of the PATH_INFO environment variable appended to the login/ endpoint. Because the web server fails to sanitize directory traversal sequences (..), an attacker can escape the web document root and access the underlying Linux-based embedded file system.

2. Exploitation Mechanics & Attack Scenario

An attacker sends a crafted HTTP GET request to the router's web management interface. By appending multiple dot-dot-slash sequences to the login path (e.g., http://<Router_IP>/login/../../../../etc/passwd or targeting configuration backup files), the attacker exploits the lack of input sanitization. The web server processes the request as a valid file path and returns the contents of the targeted system file to the unauthorized user, bypassing authentication entirely.

3. Infrastructure & Business Impact

As a vulnerability listed in the CISA KEV catalog with a high EPSS score, this flaw is actively targeted by automated scanners and botnets. Successful exploitation allows attackers to retrieve administrative credentials, Wi-Fi pre-shared keys, and network configurations. This can lead to complete device compromise, enabling man-in-the-middle (MitM) attacks, DNS hijacking, and lateral movement within the internal network.