Skip to content
Sign in
CVE-2025-302405.1MediumCWE-59

CVE-2025-30240: Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices

TP-Link Systems Inc. · HB810(US2) V1.0/1.6/2.0/2.6

Vendor fix available · Affected: TP-Link Systems Inc. HB810(US2) V1.0/1.6/2.0/2.6 · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public: not seen
  5. Not establishedNothing in the sources we check
0.2%probability of exploitation in the next 30 days
14th percentile
050100

Higher than 14% of scored CVEs

5.1MediumCVSS 4.0
LowMedium

DescriptionNVD

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem.

Coverage3 articles · 3 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 14 Aug.

Full timeline
Quiet for 5 weekslast report 9 Oct3 articles3 outlets
14 Aug · SecurityOnline first1 Oct17 OctNow
  • Fri 14 Aug, 02:41 UTC. SecurityOnline, first report. TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices.
  • Thu 8 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Four US States Sue TP-Link Over Security Claims and Router Flaws.
  • Fri 9 Oct, 14:36 UTC. The Hacker News, its first report on the story. Four More US States Sue TP-Link Over Router Security Claims.
All coveragerunning total3SecurityOnl…1SecurityWeek1The Hacker…114 Aug14 Sep15 OctNow
  • First report
  • Article
  • Running total
Show as table
3 articles about CVE-2025-30240 from 3 outlets
Published (UTC)OutletHeadline
14 Aug 02:41SecurityOnlineTP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices
8 Oct 11:00SecurityWeekFour US States Sue TP-Link Over Security Claims and Router Flaws
9 Oct 14:36The Hacker NewsFour More US States Sue TP-Link Over Router Security Claims
  1. Four More US States Sue TP-Link Over Router Security Claims
    The Hacker News · mentions it in passing
  2. Four US States Sue TP-Link Over Security Claims and Router Flaws
    SecurityWeek · mentions it in passing
  3. TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices
    SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in