Skip to content
Sign in
CVE-2025-302398.5HighCWE-321

CVE-2025-30239: Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices

TP-Link Systems Inc. · HB810(US2) V1.0/1.6/2.0/2.6

Vendor fix available · Affected: TP-Link Systems Inc. HB810(US2) V1.0/1.6/2.0/2.6 · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public: not seen
  5. Not establishedNothing in the sources we check
0.2%probability of exploitation in the next 30 days
9th percentile
050100

Higher than 9% of scored CVEs

8.5HighCVSS 4.0
LowHigh

DescriptionNVD

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.

Coverage3 articles · 3 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 14 Aug.

Full timeline
Quiet for 5 weekslast report 9 Oct3 articles3 outlets
14 Aug · SecurityOnline first1 Oct17 OctNow
  • Fri 14 Aug, 02:41 UTC. SecurityOnline, first report. TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices.
  • Thu 8 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Four US States Sue TP-Link Over Security Claims and Router Flaws.
  • Fri 9 Oct, 14:36 UTC. The Hacker News, its first report on the story. Four More US States Sue TP-Link Over Router Security Claims.
All coveragerunning total3SecurityOnl…1SecurityWeek1The Hacker…114 Aug14 Sep15 OctNow
  • First report
  • Article
  • Running total
Show as table
3 articles about CVE-2025-30239 from 3 outlets
Published (UTC)OutletHeadline
14 Aug 02:41SecurityOnlineTP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices
8 Oct 11:00SecurityWeekFour US States Sue TP-Link Over Security Claims and Router Flaws
9 Oct 14:36The Hacker NewsFour More US States Sue TP-Link Over Router Security Claims
  1. Four More US States Sue TP-Link Over Router Security Claims
    The Hacker News · mentions it in passing
  2. Four US States Sue TP-Link Over Security Claims and Router Flaws
    SecurityWeek · mentions it in passing
  3. TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices
    SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in