Is CVE-2015-3035 (TP-Link Multiple Archer Devices Directory Traversal) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2015-3035 to its Known Exploited Vulnerabilities catalogue on 25 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. Any organisation running the affected product should treat remediation as urgent.

Why active exploitation changes the response

The question is not whether CVE-2015-3035 exists, but whether it has crossed from a theoretical weakness into a live exposure. CISA’s inclusion in the KEV catalogue is the key signal that defenders should treat it as actively exploited, which moves it into urgent operational handling rather than routine backlog management.

Directory traversal issues in internet-facing appliances are especially important because they can expose files without needing full code execution. In practice, that means exposure may include configuration data, credentials, or other sensitive content that can widen the impact of a breach even when the original flaw seems narrow.

For a vulnerability management view of this class of issue, use the Vulnerability Management Guide to anchor triage, remediation SLAs, exception handling, and verification against an exploit-aware process.

What to verify on the affected devices

First confirm whether any TP-Link Archer devices are actually in scope, including models that may be deployed as home-office gear, branch equipment, or unmanaged edge assets. KEV-listed flaws often persist because organisations do not have a complete inventory of small perimeter devices.

Next verify whether the vulnerable interface is reachable from untrusted networks and whether any sensitive files could be read through the traversal path. If the device is used for remote access, Wi-Fi management, or internal routing, treat it as a potential pivot point rather than a standalone endpoint.

The CISA Known Exploited Vulnerabilities Catalog is the authoritative place to confirm KEV status and follow CISA’s required remediation posture.

The NIST National Vulnerability Database and the CVE Program are the right references when you need canonical vulnerability identity and record context before you move into remediation.

If you need a broader playbook for actively exploited flaws, the Zero-Day and Exploited Vulnerabilities Guide covers the operational pattern that applies here: fast triage, exposure reduction, and compromise assessment.

How to reduce exposure when remediation is delayed

Where patching or replacement cannot happen immediately, the priority is to narrow who can reach the device, not to assume the flaw is low risk because the asset is “just a router.” Restrict management access, remove external reachability where possible, and review whether any exposed admin surface can be isolated behind trusted networks.

Because traversal flaws can reveal stored data, review the device configuration for any secrets, backup files, logs, or administrative material that should not be present on the appliance. If the device stores reusable credentials or has been managed with shared passwords, rotate those credentials after containment.

For additional practical context on perimeter and embedded-device exposure, the IoT Security Guide is useful because the same containment logic applies to connected devices with weak segmentation and long-lived management access.

Risk and Threat Considerations

Active exploitation changes the risk from “known weakness” to “probable targeting condition.” Directory traversal is attractive because it can be used for low-noise reconnaissance, file disclosure, and follow-on credential theft when the appliance holds configuration material or management secrets.

Failure mechanism: An attacker sends crafted path input such as traversal sequences to escape the intended directory boundary and read files that should never be accessible through the web interface. On edge devices, that can expose configuration state, authentication material, or internal operational details.

Impact: File disclosure can enable device takeover, privilege escalation on adjacent systems, or broader compromise if the exposed content includes reusable secrets, network topology, or management credentials. In a perimeter device, even “read only” access can be enough to turn one appliance into an entry point for further intrusion.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP API Security Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed flaws require prioritised discovery, triage, and remediation of exposed assets.
Recommendation — Prioritise and remediate KEV-listed devices through continuous vulnerability management.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	This subject is about managing an actively exploited vulnerability and reducing exposure quickly.
Recommendation — Track, prioritise, and remediate the vulnerable device under your vulnerability management process.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Active exploitation makes flaw remediation and verification the central control response.
Recommendation — Patch or mitigate the flaw promptly and verify the remediation took effect.
OWASP ASVS	V15 — Secure Coding and Architecture	Directory traversal is an input-handling and boundary-checking weakness affecting application design.
Recommendation — Validate path handling and prevent traversal at the architecture and implementation layer.
OWASP API Security Top 10	API8 — Security Misconfiguration	Exposed management interfaces and unsafe file access on networked devices often reflect misconfiguration risk.
Recommendation — Reduce exposed management surfaces and harden device configuration to limit abuse paths.

Practitioner Guidance

What to prioritise: Treat this as an exposure and inventory problem first, not only a patching problem. If you cannot quickly prove the device is absent, patched, or fully isolated, assume it is at elevated risk until verified otherwise.

What to verify: Check whether any Archer devices are internet reachable, whether administrative interfaces are exposed, and whether any sensitive files or credentials could be reachable through the traversal path. If the appliance has been used for remote administration, include credential rotation in the response.

Decision rule: If the device is in production or supports remote access, remediate immediately or isolate it before investigating whether exploitation has already occurred. If patching is delayed, containment and compromise assessment should move ahead together, not sequentially.

Practitioner takeaway: For KEV-listed device flaws, the operational question is not “is there a patch note,” but “has the exposed asset already become an attacker foothold or a source of leaked secrets?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org