TP‑Link Vulnerabilities

Overview

TP‑Link has disclosed five high‑severity vulnerabilities impacting ISP‑managed Aginet networking products, including routers, mesh systems, PON devices, and xDSL modems. These flaws, tracked as CVE‑2025‑30237 through CVE‑2025‑30241, could allow attackers to bypass authentication, escalate privileges, steal sensitive data, read device files, and execute operating system commands.

Key Vulnerabilities

• CVE‑2025‑30237 – Authentication bypass (CVSS 8.7): Broken access control lets unauthenticated attackers send crafted requests to privileged endpoints, potentially gaining full device control.
• CVE‑2025‑30238 – Privilege escalation (CVSS 8.6): Low‑privileged users can perform admin‑level actions, including creating privileged accounts.
• CVE‑2025‑30239 – Hardcoded cryptographic keys (CVSS 8.5): Attackers with storage access can recover embedded keys and decrypt sensitive configuration data.
• CVE‑2025‑30240 – Arbitrary file read (CVSS 5.1): Improper symbolic link handling on USB storage allows access to router filesystem files.
• CVE‑2025‑30241 – OS command injection (CVSS 8.6): Poor input validation lets authenticated attackers inject system‑level commands.

Impacted Devices

Models across TP‑Link’s HB, HX, HC, EB, EC, EX, XC, XX, and VX series are affected. Examples include:

• HB810, HB710
• EX220, EX222, EX920
• EC220‑G5
• XX530v
• VX1800v

The exact impact depends on regional models, ISP customizations, and firmware versions.

Security Implications

• Unauthenticated access: Attackers can bypass login and gain root‑level control.
• Expanded privileges: Limited users can escalate to administrators.
• Sensitive data exposure: ISP credentials and configuration data at risk.
• Command execution: Malicious actors can run arbitrary OS commands.

Defensive Guidance

TP‑Link advises:

• Update firmware: ISP‑managed devices may receive automatic updates; check your router admin interface or ISP app.
• Contact ISP: Confirm whether your device is affected and when patches will be deployed.
• Restrict management exposure: Disable unnecessary remote management features.
• Use strong credentials: Ensure unique administrator passwords.
• Limit local access: Keep untrusted users off the local network.

Expert in the Cloud Insight

These vulnerabilities highlight the risks of ISP‑managed networking gear, where patch cycles depend on provider coordination. Attackers exploiting authentication bypass or OS command injection could gain complete control of home or enterprise routers, turning them into entry points for larger campaigns. The lesson is clear: firmware updates and strict access controls are critical for securing edge devices.