CVE-2025-30241
OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges.
Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges.
Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.
- Record
CVE-2025-30241- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2025-210677
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges.
Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.
- Record
EUVD-2025-210677- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6v23-65fj-8g7c
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize...
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges.
Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.
- Record
GHSA-6v23-65fj-8g7c- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges.
Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.
- Record
CVE-2025-30241- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
- tp-link systems inc. eb210 pro(eu1) 1.0
- tp-link systems inc. eb210 pro(us1) 1.0
- tp-link systems inc. eb810v(eu1) v1.0
- tp-link systems inc. ex220(br) v1.0/1.20/1.28/1.29/1.8
- tp-link systems inc. ex220(br) v2.0
- tp-link systems inc. ex220(eu1) v1.0/1.20
- tp-link systems inc. ex220(ru) v1.0
- tp-link systems inc. ex220(us1) v1.0
- tp-link systems inc. ex222(eu1) v1.0
- tp-link systems inc. ex222(kr) v1.0
- tp-link systems inc. ex222(us1) v1.0
- tp-link systems inc. ex520v(eu1)1.0
Show 19 moreShow less
- tp-link systems inc. ex820v(eu1) v1.0
- tp-link systems inc. ex920(us2) v1.6/v1.0
- tp-link systems inc. hb210 pro(eu1)1.0
- tp-link systems inc. hb210 pro(us2)1.0/1.6
- tp-link systems inc. hb210(eu1) 1.0
- tp-link systems inc. hb210(us2) 1.0
- tp-link systems inc. hb410( eu1) 1.0
- tp-link systems inc. hb610(ca) v2.0
- tp-link systems inc. hb610(eu1)
- tp-link systems inc. hb610(us2) v2.6/2.0
- tp-link systems inc. hb710(eu1) 1.0
- tp-link systems inc. hb710(us2) v1.6/1.0
- tp-link systems inc. hb810(eu1) v2.0
- tp-link systems inc. hb810(us2) v1.0/1.6/2.0/2.6
- tp-link systems inc. vx420-g2h(au) v3.0
- tp-link systems inc. vx800v(de) v1.0
- tp-link systems inc. xx230v(br) v1.0
- tp-link systems inc. xx530v(br)v2.0
- tp-link systems inc. xx530v(eu1)
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-30241 is a high vulnerability (CVSS 8.6) in Tp-link Systems Inc. Eb210 Pro(eu1) 1.0, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.