Deviceways

Router

TP-LINK TL-WDR3600

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
v1.1 / v1.2 / v1.3 / v1.4 / v1.5
Get OpenWrt firmware Release listed · 25.12.6
v1.1,v1.2,v1.3,v1.4,v1.5; v1.x
Open hardware record
Original project github.com

Recorded configuration: 8 MB flash; 128 MB RAM

First installation
GUI OEM; U-Boot TFTP recovery
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

tp-link tl-wdr3600 v1 — device documentation (github.com)

Hardware revision
v1.1,v1.2,v1.3,v1.4,v1.5

Device details

TP-LINK TL-WDR3600 — TechInfoDepot (github.com)TP-LINK TL-WDR3600 — WikiDevi (github.com)

Hardware revision
v1.x

Device details

Device details — v1 — Source documentation (openwrt.org)

Hardware revision
v1.1 / v1.2 / v1.3 / v1.4 / v1.5

OpenWrt · v1.1 / v1.2 / v1.3 / v1.4 / v1.5

OpenWrt · v1.1 / v1.2 / v1.3 / v1.4 / v1.5 — v1 — Source documentation (openwrt.org)

Installation routes recorded
GUI OEM, U-Boot TFTP recovery
Recovery routes recorded
U-Boot TFTP recovery
Availability recorded by source
Discontinued 2015

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

Listed in CISA KEV ↗CVSS 7.5 (v3.1)

TP-LINK TL-WDR3600

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0),…

CVE-2015-3035

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
Public disclosure CVE updated

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.

CVE published

Listed in CISA KEV ↗CVSS 6.5 (v3.1)

TL-WDR3600

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

CVE-2023-50224

Affected firmware
V2
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
Public disclosure CVE updated

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

ZDI-23-1808 — TL-WDR3600 (zerodayinitiative.com) ↗vendor-provided URL — TL-WDR3600 (tp-link.com) ↗vendor-advisory — TL-WDR3600 (tp-link.com) ↗
Check more security advisories for this device · CVE.org