CVE-2025-30241 - Vulnerability Details

- OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices

Description

Certain web
interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before
passing it to system-level command execution functions. An authenticated adjacent attacker may inject
specially crafted input to execute arbitrary operation system commands with
elevated privileges.

Successful
exploitation may allow execution of arbitrary system commands, potentially
leading to full device compromise.

Published: 2026-08-10

Score: 8.6 High

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TP-Link Systems Inc.

HB810(US2) V1.0/1.6/2.0/2.6

unaffected

Version	Status	Constraints
`0`	affected	< 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n

TP-Link Systems Inc.

HB810(EU1) V2.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n

TP-Link Systems Inc.

HB710(US2) V1.6/1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n

TP-Link Systems Inc.

HB710(EU1) 1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n

TP-Link Systems Inc.

HB610(US2) V2.6/2.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n

TP-Link Systems Inc.

HB610(EU1)

unaffected

Version	Status	Constraints
`0`	affected	< 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n

TP-Link Systems Inc.

HB610(CA) V2.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n

TP-Link Systems Inc.

HB410( EU1) 1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n

TP-Link Systems Inc.

HB210(US2) 1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n

TP-Link Systems Inc.

HB210(EU1) 1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n

TP-Link Systems Inc.

HB210 Pro(EU1)1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n

TP-Link Systems Inc.

HB210 Pro(US2)1.0/1.6

unaffected

Version	Status	Constraints
`0`	affected	< 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n

TP-Link Systems Inc.

EB210 Pro(EU1) 1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n

TP-Link Systems Inc.

EB210 Pro(US1) 1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n

TP-Link Systems Inc.

EB810v(EU1) V1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n

TP-Link Systems Inc.

EX220(BR) V1.0/1.20/1.28/1.29/1.8

unaffected

Version	Status	Constraints
`0`	affected	< 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n

TP-Link Systems Inc.

EX220(BR) V2.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n

TP-Link Systems Inc.

EX220(EU1) V1.0/1.20

unaffected

Version	Status	Constraints
`0`	affected	< 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n

TP-Link Systems Inc.

EX220(RU) V1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n

TP-Link Systems Inc.

EX220(US1) V1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n

TP-Link Systems Inc.

EX222(EU1) V1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n

TP-Link Systems Inc.

EX222(KR) V1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915

TP-Link Systems Inc.

EX222(US1) V1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n

TP-Link Systems Inc.

EX520v(EU1)1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n

TP-Link Systems Inc.

EX820v(EU1) V1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n

TP-Link Systems Inc.

EX920(US2) V1.6/V1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n

TP-Link Systems Inc.

XX530v(BR)v2.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n

TP-Link Systems Inc.

XX530v(EU1)

unaffected

Version	Status	Constraints
`0`	affected	< 0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n

TP-Link Systems Inc.

XX230v(BR) V1.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n

TP-Link Systems Inc.

VX800v(DE) V1.0

unaffected

Version	Status	Constraints
`0`	affected	< 800.0.16

TP-Link Systems Inc.

VX420-G2h(AU) V3.0

unaffected

Version	Status	Constraints
`0`	affected	< 0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://www.tp-link.com/us/support/faq/5239/

History

Mon, 10 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Description		Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.
Title		OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices
Weaknesses		CWE-78
References		https://www.tp-link.com/us/support/faq/5239/
Metrics		cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: TPLink

Published: 2026-08-10T22:26:08.525Z

Updated: 2026-08-10T22:26:08.525Z

Reserved: 2025-03-19T11:09:33.245Z

Link: CVE-2025-30241

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-10T23:30:07Z

Weaknesses

CWE-78

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object