Skip to content
Sign in
CVE-2025-302418.6HighCWE-78

CVE-2025-30241: OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices

TP-Link Systems Inc. · HB810(US2) V1.0/1.6/2.0/2.6

Vendor fix available · Affected: TP-Link Systems Inc. HB810(US2) V1.0/1.6/2.0/2.6 · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public: not seen
  5. Not establishedNothing in the sources we check
0.4%probability of exploitation in the next 30 days
35th percentile
050100

Higher than 35% of scored CVEs

8.6HighCVSS 4.0
LowHigh

DescriptionNVD

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.

Coverage3 articles · 3 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 14 Aug.

Full timeline
Quiet for 5 weekslast report 9 Oct3 articles3 outlets
14 Aug · SecurityOnline first1 Oct17 OctNow
  • Fri 14 Aug, 02:41 UTC. SecurityOnline, first report. TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices.
  • Thu 8 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Four US States Sue TP-Link Over Security Claims and Router Flaws.
  • Fri 9 Oct, 14:36 UTC. The Hacker News, its first report on the story. Four More US States Sue TP-Link Over Router Security Claims.
All coveragerunning total3SecurityOnl…1SecurityWeek1The Hacker…114 Aug14 Sep15 OctNow
  • First report
  • Article
  • Running total
Show as table
3 articles about CVE-2025-30241 from 3 outlets
Published (UTC)OutletHeadline
14 Aug 02:41SecurityOnlineTP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices
8 Oct 11:00SecurityWeekFour US States Sue TP-Link Over Security Claims and Router Flaws
9 Oct 14:36The Hacker NewsFour More US States Sue TP-Link Over Router Security Claims
  1. Four More US States Sue TP-Link Over Router Security Claims
    The Hacker News · mentions it in passing
  2. Four US States Sue TP-Link Over Security Claims and Router Flaws
    SecurityWeek · mentions it in passing
  3. TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices
    SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in