Key Takeaways
- TP‑Link disclosed five vulnerabilities (CVE‑2025‑30237 to CVE‑2025‑30241) affecting ISP‑managed Aginet devices such as mesh systems, routers, PON terminals, and xDSL modems.
- The most critical flaw (CVE‑2025‑30237) is an authentication bypass in the web interface (CVSS v4 8.7) that lets an unauthenticated attacker on an adjacent network gain full device control.
- Additional high‑severity issues include improper authorization (CVE‑2025‑30238, CVSS 8.6), hardcoded cryptographic keys (CVE‑2025‑30239, CVSS 8.5), and OS command injection (CVE‑2025‑30241, CVSS 8.6); a medium‑severity arbitrary file‑read flaw (CVE‑2025‑30240, CVSS 5.1) requires physical USB access.
- Exploitation generally needs local or adjacent‑network access—or, for the file‑read issue, physical access to a USB port—so limiting management‑interface exposure and securing the LAN are essential.
- Firmware patches are distributed through ISPs; users should check the router UI or provider portal for updates, contact their ISP if none appear, and apply strong credentials, disable unnecessary remote features, segment the network, and secure USB ports until patches arrive.
Overview of the TP‑Link Security Advisory
TP‑Link published a security advisory (last updated August 10, 2026) detailing five vulnerabilities tracked as CVE‑2025‑30237 through CVE‑2025‑30241 that impact its Aginet line of networking gear. The affected devices include ISP‑managed mesh systems, residential routers, PON terminals, and xDSL modems that are typically provisioned, configured, and updated by internet service providers. Because firmware distribution is often controlled by the ISP, availability of patches can differ by region and operator, leaving some users exposed until the provider pushes an update. The advisory assigns CVSS v4 scores ranging from 5.1 to 8.7, reflecting a spectrum from medium to critical severity. All flaws require either local network adjacency or, in one case, physical access to a USB port, limiting remote exploitation but still posing a significant risk to home and small‑business networks.
Authentication Bypass – CVE‑2025‑30237
The most severe issue, CVE‑2025‑30237, is an authentication bypass in the web‑based management interface with a CVSS v4 score of 8.7. It stems from broken access control on certain REST‑like endpoints that fail to verify whether a requestor possesses valid credentials. An attacker who is on the same LAN or an adjacent network (e.g., via Wi‑Fi guest segment) can craft a specially formatted HTTP request that reaches privileged functions such as firmware upgrade, configuration export, or user management without supplying a username or password. Successful exploitation grants the attacker full administrative control over the device, enabling them to alter settings, install malicious firmware, or use the router as a pivot for further internal network attacks.
Improper Authorization – CVE‑2025‑30238
CVE‑2025‑30238, rated 8.6 CVSS v4, describes an improper authorization flaw within the device’s user‑management subsystem. A low‑privileged authenticated user—such as a guest account or a user with limited configuration rights—can manipulate API calls to perform actions reserved for administrators. This includes creating new privileged accounts, changing administrative passwords, modifying WAN or LAN settings, and altering firewall rules. By chaining this vulnerability with the authentication bypass or simply exploiting an existing low‑level account, an attacker can quickly escalate their privileges and achieve complete control of the router or mesh node, effectively nullifying any role‑based restrictions intended by the ISP.
Hardcoded Cryptographic Keys – CVE‑2025‑30239
The third high‑severity vulnerability, CVE‑2025‑30239, carries a CVSS v4 score of 8.5 and involves the presence of hardcoded cryptographic keys embedded in the firmware image. These keys are used to encrypt sensitive configuration blobs, such as ISP‑provided credentials, VPN secrets, and TR‑069 management data. An attacker who gains read access to the device’s flash storage—whether via physical tampering, a compromised firmware update channel, or exploitation of another vulnerability—can extract the static keys and decrypt the protected blobs. Exposure of ISP‑related service settings may allow the adversary to impersonate the subscriber, hijack services, or launch further attacks against the provider’s infrastructure, amplifying the impact beyond the individual premises.
Arbitrary File Read via USB – CVE‑2025‑30240
CVE‑2025‑30240 is a medium‑severity arbitrary file‑read flaw with a CVSS v4 score of 5.1. It resides in the USB HTTPS access path that allows users to plug a USB storage device into the router and view files through a web interface. The implementation does not properly validate symbolic links; an attacker with physical access can create a malicious symlink on the USB drive that points to a sensitive file elsewhere in the router’s filesystem (e.g., /etc/passwd, shadow, or configuration archives). When the symlink is followed during file enumeration, the attacker can read those files remotely via the USB HTTPS service. While requiring physical interaction, this vulnerability could be exploited in scenarios where the router is placed in a semi‑public location (e.g., a lobby, office shared space) or when an insider with brief access to the USB port seeks to harvest credentials.
OS Command Injection – CVE‑2025‑30241
The final high‑severity issue, CVE‑2025‑30241, scores 8.6 CVSS v4 and is an OS command injection vulnerability in several web‑interface components. The affected code fails to adequately sanitize or validate user‑supplied input before passing it to underlying system commands (e.g., ping, traceroute, or diagnostic utilities). An authenticated attacker on the local network can inject shell metacharacters (such as ;, &, |, or $()) into parameters like hostname or IP address fields, causing the router to execute arbitrary commands with the privileges of the web‑service process, which often runs as root. Successful exploitation enables full command‑line access, allowing the adversary to modify firmware, install backdoors, exfiltrate logs, or use the device as a launchpad for lateral movement within the subscriber’s LAN.
Affected Product Series and Example Models
The vulnerabilities affect a broad range of TP‑Link’s Aginet‑based hardware, spanning the HB, HX, HC, EB, EC, EX, XC, XX, and VX series. Specific model numbers cited in the advisory include the HB810, HB710, EX220, EX222, EX920, EC220‑G5, XX530v, and VX1800v variants, though the exact impact varies depending on regional firmware, hardware revision, and any ISP‑specific customizations. Because many of these devices are sold under ISP branding (e.g., as part of a bundled modem‑router), the TP‑Link product label may not be visible to the end user, making it essential to consult the ISP’s device list or the router’s administrative interface for the exact model and firmware version.
Remediation Process and ISP Coordination
TP‑Link states that remediation for ISP‑managed Aginet devices will be coordinated directly with the service providers that deploy and maintain the firmware. In many deployments, updates are pushed automatically through the ISP’s remote‑management platform (often TR‑069 or a similar ACS). End users are advised to first check the router’s administration interface or the provider’s subscriber portal for any available firmware upgrades. If no update appears, customers should contact their ISP’s technical support to confirm whether their specific device is affected and to obtain an estimated timeline for a patched release. Given the reliance on ISP‑controlled update cycles, patch latency can vary widely, underscoring the importance of proactive communication.
Practical Mitigation Recommendations
While awaiting patches, users can reduce risk by limiting exposure of the router’s management interfaces. This includes disabling remote‑access features such as WAN‑side HTTP/HTTPS administration, turning off UPnP or TR‑069 if not required, and ensuring the wireless guest network is isolated from the LAN where the router’s admin UI resides. Strong, unique administrator passwords should be employed, and default credentials must be changed immediately. Network segmentation—keeping IoT devices, guest devices, and untrusted hosts on separate VLANs or subnets—helps prevent an attacker who gains a foothold from reaching the router’s management plane. Additionally, physical security of the USB ports is advisable; disabling USB storage support in the firmware (if the option exists) eliminates the file‑read vector. Regularly reviewing logs for unexpected authentication attempts or anomalous command executions can aid early detection.
Conclusion and Ongoing Vigilance
The disclosure of CVE‑2025‑30237 through CVE‑2025‑30241 highlights the security challenges inherent in ISP‑managed customer‑premises equipment, where the division of responsibility between vendor, provider, and end user can delay patch deployment. The combination of authentication bypass, privilege escalation, hardcoded secrets, file‑system exposure, and command injection provides multiple pathways for an adversary to achieve full control of a home or small‑business router. By staying informed about firmware versions, engaging with ISPs for timely updates, and applying the outlined hardening measures, users can significantly diminish the likelihood of successful exploitation and protect both their local networks and the broader service‑provider infrastructure from downstream abuse.