TP-Link Tl-WDR3500 Firmware vulnerabilities

2 CVEs affecting TP-Link Tl-WDR3500 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-6487, published 2019-01-18.

More from TP-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-3035: TP-Link Multiple Archer Devices Directory Traversal Vulnerability, published 2015-04-22. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 83.9% chance of exploitation in the next 30 days. Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500…
• CVE-2019-6487, published 2019-01-18. High severity, CVSS 8.8. EPSS: 8.5% chance of exploitation in the next 30 days. TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included…