CVE-2025-30237
Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations.
Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations.
Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
- Record
CVE-2025-30237- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2025-210673
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations.
Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
- Record
EUVD-2025-210673- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gcr6-hgjr-2h8p
The affected TP-Link Aginet devices contain a flaw in the web management interface where...
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations.
Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
- Record
GHSA-gcr6-hgjr-2h8p- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations.
Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
- Record
CVE-2025-30237- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
- tp-link systems inc. ex141(br) v1.0/1.9
- tp-link systems inc. ex141(eu1) v1.0
- tp-link systems inc. ex141(us1) v1.0
- tp-link systems inc. ex220(br) v1.0/1.20/1.28/1.29/1.8
- tp-link systems inc. ex220(br) v2.0
- tp-link systems inc. ex220(eu1) v1.0/1.20
- tp-link systems inc. ex220(ru) v1.0
- tp-link systems inc. ex220(us1) v1.0
- tp-link systems inc. ex222(eu1) v1.0
- tp-link systems inc. ex222(kr) v1.0
- tp-link systems inc. ex222(us1) v1.0
- tp-link systems inc. ex511(br) v2.0/2.8/2.9
Show 44 moreShow less
- tp-link systems inc. ex511(eu1) v2.0
- tp-link systems inc. ex511(us1) v2.0
- tp-link systems inc. ex520(us1) v1.0
- tp-link systems inc. ex520v(eu1)1.0
- tp-link systems inc. ex521(us1) v1.0
- tp-link systems inc. ex820v(eu1) v1.0
- tp-link systems inc. ex920(us2) v1.6/v1.0
- tp-link systems inc. hb210 pro(eu1)1.0
- tp-link systems inc. hb210 pro(us2)1.0/1.6
- tp-link systems inc. hb210(eu1) 1.0
- tp-link systems inc. hb210(us2) 1.0
- tp-link systems inc. hb410( eu1) 1.0
- tp-link systems inc. hb610(ca) v2.0
- tp-link systems inc. hb610(eu1)
- tp-link systems inc. hb610(us2) v2.6/2.0
- tp-link systems inc. hb710(eu1) 1.0
- tp-link systems inc. hb710(us2) v1.6/1.0
- tp-link systems inc. hb810(eu1) v2.0
- tp-link systems inc. hb810(us2) v1.0/1.6/2.0/2.6
- tp-link systems inc. hc220-g5(br) v1.30
- tp-link systems inc. hc220-g5(eu1) v1.20/1.0
- tp-link systems inc. hc220-g5(us1) v1.0/1.6
- tp-link systems inc. hx141(eu1) v1.0
- tp-link systems inc. hx220(au) v1.0
- tp-link systems inc. hx220(ca) v1.0
- tp-link systems inc. hx220(eu1) v1.0
- tp-link systems inc. hx220(us1) v1.0/1.6
- tp-link systems inc. hx510(au) v1.0/2.0
- tp-link systems inc. hx510(ca) v1.0/2.0
- tp-link systems inc. hx510(eu1) v2.0
- tp-link systems inc. hx510(us1) v2.0
- tp-link systems inc. hx510(us2) 2.6
- tp-link systems inc. hx710 pro(eu1) v1.0
- tp-link systems inc. hx710(eu1) v1.0
- tp-link systems inc. vx1800v(eu1) v1.0
- tp-link systems inc. vx420-g2h(au) v3.0
- tp-link systems inc. vx800v(de) v1.0
- tp-link systems inc. xc220-g3v(eu1) v2.30
- tp-link systems inc. xc220-g3v(us1) v2.30
- tp-link systems inc. xx230v(br) v1.0
- tp-link systems inc. xx530v(br)v1.0
- tp-link systems inc. xx530v(br)v2.0
- tp-link systems inc. xx530v(eu1)
- tp-link systems inc. xx530v(us1)
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-30237 is a high vulnerability (CVSS 8.7) in Tp-link Systems Inc. Ex141(br) V1.0/1.9, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. No source names a fixed version.