CVE-2025-302388.6HighCWE-863
CVE-2025-30238: Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices
TP-Link Systems Inc. · HB810(US2) V1.0/1.6/2.0/2.6
Vendor fix available · Affected: TP-Link Systems Inc. HB810(US2) V1.0/1.6/2.0/2.6 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.2%probability of exploitation in the next 30 days
9th percentile
050100
Higher than 9% of scored CVEs
8.6HighCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.
Coverage3 articles · 3 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 14 Aug.
Quiet for 5 weekslast report 9 Oct3 articles3 outlets
- Fri 14 Aug, 02:41 UTC. SecurityOnline, first report. TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices.
- Thu 8 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Four US States Sue TP-Link Over Security Claims and Router Flaws.
- Fri 9 Oct, 14:36 UTC. The Hacker News, its first report on the story. Four More US States Sue TP-Link Over Router Security Claims.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 14 Aug 02:41 | SecurityOnline | TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices |
| 8 Oct 11:00 | SecurityWeek | Four US States Sue TP-Link Over Security Claims and Router Flaws |
| 9 Oct 14:36 | The Hacker News | Four More US States Sue TP-Link Over Router Security Claims |
- Four More US States Sue TP-Link Over Router Security ClaimsThe Hacker News · mentions it in passing
- Four US States Sue TP-Link Over Security Claims and Router FlawsSecurityWeek · mentions it in passing
- TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh DevicesSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.