TP-Link Tl-WDR3600 Firmware vulnerabilities

3 CVEs affecting TP-Link Tl-WDR3600 Firmware, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-50224, published 2024-05-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-3035: TP-Link Multiple Archer Devices Directory Traversal Vulnerability, published 2015-04-22. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 83.9% chance of exploitation in the next 30 days. Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500…
CVE-2023-50224: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability, published 2024-05-03. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2025-09-03. EPSS: 20% chance of exploitation in the next 30 days. TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected…
CVE-2019-6487, published 2019-01-18. High severity, CVSS 8.8. EPSS: 8.5% chance of exploitation in the next 30 days. TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included…