Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices

Part of the CVE-2025-30237 story · since 14 Aug

Quiet for 5 weekslast report 9 Oct3 articles3 outlets
14 Aug · SecurityOnline first1 Oct17 OctNowThis article1st of 3
  • Fri 14 Aug, 02:41 UTC. SecurityOnline, first report. TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices. This article, 1st of 3.
  • Thu 8 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Four US States Sue TP-Link Over Security Claims and Router Flaws.
  • Fri 9 Oct, 14:36 UTC. The Hacker News, its first report on the story. Four More US States Sue TP-Link Over Router Security Claims.

TP-Link disclosed five vulnerabilities affecting ISP-managed networking devices, including routers and mesh systems. The major issues include authentication bypass and command injection, with CVSS scores reaching up to 8.7. None of these vulnerabilities have been confirmed to be exploited yet. Users are advised to apply the latest security updates provided through their ISPs. The vulnerabilities range in severity, with four categorized as high and one medium.

Specific CVEs include authentication bypass (CVE-2025-30237), privilege escalation (CVE-2025-30238), command injection (CVE-2025-30241), sensitive data exposure (CVE-2025-30239), and arbitrary file read (CVE-2025-30240). It's crucial for users to ensure their devices are updated to mitigate risks.

How the story developed

All 3 articles
Quiet for 5 weekslast report 9 Oct3 articles3 outlets

3 articles from 3 outlets since 14 Aug. Quiet since 9 Oct. This was the first report.

Now14 Aug158 Oct910First reportSecurityOnline · 14 Aug, 02:41Picked up againafter 8 weeks quiet
  • Fri 14 Aug, 02:41 UTC. SecurityOnline, first report. TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices. This article, 1st of 3.
  • Thu 8 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Four US States Sue TP-Link Over Security Claims and Router Flaws.
  • Fri 9 Oct, 14:36 UTC. The Hacker News, its first report on the story. Four More US States Sue TP-Link Over Router Security Claims.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Fri 14 AugDay 01
    1. TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices02:41 · SecurityOnline · First report · This article, 1st of 3

  2. Quiet for 8 weeks

    Thu 8 OctDay 551
    1. Four US States Sue TP-Link Over Security Claims and Router Flaws11:00 · SecurityWeek · Picked up again
  3. Fri 9 OctDay 561
    1. Four More US States Sue TP-Link Over Router Security Claims14:36 · The Hacker News

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in