Multiple TP-Link Aginet Vulnerabilities Allow Authentication Bypass and OS Command Execution

TP-Link has disclosed multiple security vulnerabilities affecting its ISP-managed Aginet networking products, including mesh systems, routers, PON devices and xDSL modems.

The vulnerabilities are tracked as CVE-2025-30237 through CVE-2025-30241 and include authentication bypass, privilege escalation, hardcoded cryptographic keys, arbitrary file read and OS command injection.

Several of the vulnerabilities have high CVSS scores and could allow attackers with network access to gain significant control over affected devices.

Key Highlights

• Five vulnerabilities identified.
• Affected product family: TP-Link Aginet.
• CVEs: CVE-2025-30237, CVE-2025-30238, CVE-2025-30239, CVE-2025-30240, CVE-2025-30241.
• CVE-2025-30237 has a CVSS v4 score of 8.7.
• CVE-2025-30238 has a CVSS score of 8.6.
• CVE-2025-30239 has a CVSS score of 8.5.
• CVE-2025-30240 has a CVSS score of 5.1.
• CVE-2025-30241 has a CVSS score of 8.6.
• Impacts include authentication bypass, privilege escalation, data exposure and command execution.
• ISP-managed devices may receive remediation through service-provider management platforms.

Vulnerability Overview

CVE-2025-30237 — Authentication Bypass

The most serious authentication issue affects the web-management interface.

The vulnerability results from broken access controls on certain endpoints.

An attacker with access to the affected network may send specially crafted requests to reach privileged functionality without providing valid credentials.

Successful exploitation could allow an unauthenticated attacker to obtain extensive control over the affected device.

CVE-2025-30238 — Privilege Escalation

CVE-2025-30238 is an improper authorization vulnerability affecting user-management functionality.

A low-privileged authenticated user may be able to perform administrator-level operations.

Potential actions include:

• Creating privileged accounts
• Modifying administrator settings
• Changing critical device configuration
• Expanding control over the affected router or mesh device

CVE-2025-30239 — Hardcoded Cryptographic Keys

CVE-2025-30239 involves cryptographic keys embedded within device firmware.

An attacker who gains access to the device's storage could recover these keys and use them to decrypt protected configuration information.

Potentially exposed information includes:

• Credentials
• ISP configuration
• Service-related settings
• Other protected configuration data

The exposure of these values could facilitate further compromise.

CVE-2025-30240 — Arbitrary File Read

CVE-2025-30240 is an arbitrary file-read vulnerability affecting the USB HTTPS access mechanism.

The issue is related to improper handling of symbolic links on external USB storage.

An attacker with physical access to the affected device could potentially create a malicious symbolic link and use it to access sensitive files from the router's filesystem.

CVE-2025-30241 — OS Command Injection

CVE-2025-30241 is an OS command injection vulnerability affecting certain web-interface components.

Insufficient validation of user-controlled input allows an authenticated attacker on the local network to inject commands into system-level functions.

Successful exploitation could result in command execution with elevated privileges and potentially complete control of the affected device.

Affected hardware includes models from several TP-Link product series, including:

• HB
• HX
• HC
• EB
• EC
• EX
• XC
• XX
• VX

Examples include HB810, HB710, EX220, EX222, EX920, EC220-G5, XX530v and VX1800v variants.

The exact impact depends on the regional model, hardware revision, ISP customization and installed firmware.

Potential Attack Impact

Successful exploitation of these vulnerabilities could allow attackers to:

• Bypass authentication
• Create privileged accounts
• Modify router configuration
• Extract sensitive configuration information
• Read files from affected devices
• Execute operating-system commands
• Establish persistent access
• Intercept network traffic
• Use compromised networking devices as a pivot point into internal networks

Compromised routers can provide attackers with a strategic position between users and the wider network.

Detection and Hunting Opportunities

Security teams should monitor for:

• Unexpected administrative accounts
• Changes to router administrator configuration
• Unusual requests to web-management endpoints
• Repeated authentication failures followed by successful access
• Unexpected configuration changes
• Suspicious command execution from router management interfaces
• Unusual outbound connections from routers
• Unexpected DNS configuration changes
• Unauthorized firmware changes
• Suspicious USB devices connected to routers
• Unexpected access to router filesystem resources
• Router communication with unfamiliar external IP addresses

Recommended Mitigations

1. Identify all TP-Link Aginet devices deployed across the environment.
2. Determine the exact hardware and firmware versions.
3. Apply available security updates immediately.
4. Contact the ISP if the device is ISP-managed and the update is not available.
5. Restrict access to router management interfaces.
6. Disable unnecessary remote management functionality.
7. Use strong and unique administrator credentials.
8. Review existing administrator accounts for unauthorized users.
9. Monitor configuration changes.
10. Restrict untrusted users from accessing the local network.
11. Monitor outbound traffic originating from networking appliances.
12. Replace unsupported devices where security updates are unavailable.

Threat Assessment

The vulnerabilities are particularly significant because affected devices operate at the network edge and can provide attackers with privileged access to network infrastructure.

The combination of authentication bypass, privilege escalation and command injection increases the potential impact from unauthorized access to complete device compromise.

ISP-managed deployments also introduce an additional remediation dependency because firmware availability can vary according to the service provider and region.

CVE IDs

Conclusion

Organizations using TP-Link Aginet networking equipment should inventory affected devices and verify that the latest available firmware has been deployed.

Security teams should also monitor router-management activity, administrator-account changes, configuration modifications and unusual outbound connections.

Where patches are unavailable, management interfaces should be isolated from untrusted networks and affected devices should be replaced when practical.