TP-Link Archer c9 Firmware vulnerabilities

3 CVEs affecting TP-Link Archer c9 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-38563, published 2023-09-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-3035: TP-Link Multiple Archer Devices Directory Traversal Vulnerability, published 2015-04-22. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 83.9% chance of exploitation in the next 30 days. Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500…
CVE-2020-5797, published 2020-11-21. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. UNIX Symbolic Link (Symlink) Following in TP-Link Archer C9(US)_V1_180125 firmware allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a…
CVE-2023-38563, published 2023-09-06. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacent unauthenticated attacker to execute…