EUVD-2025-210673
GHSA-gcr6-hgjr-2h8p
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network vector (AV:A) per description; no authentication or interaction required; full CIA impact on device with no scope change to subsequent systems.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
3DescriptionCVE.org
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations.
Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
Articles & Coverage 1
AnalysisAI
Authentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credentials to invoke privileged management operations and gain full administrative control of the device. The flaw (CWE-862, Missing Authorization) stems from inconsistent enforcement of access control checks on specific web management interface endpoints - certain privileged API handlers accept and act on requests without verifying caller identity. The vulnerability affects over 60 distinct model/region/hardware-revision combinations across the HB, HX, EX, HC, VX, and XX Aginet product lines; no public exploit code or CISA KEV listing is identified at time of analysis, but the vendor has released firmware patches.
Technical ContextAI
The affected devices run an embedded HTTP-based management interface exposing configuration and control endpoints. CWE-862 (Missing Authorization) identifies the root cause as the absence of authorization enforcement on specific endpoint handlers - the web server processes requests to privileged routes without verifying that the caller holds a valid authenticated session or appropriate privilege level. This differs from CWE-306 (missing authentication) in that authentication infrastructure likely exists but is not applied uniformly across all sensitive routes. CPE strings confirm the scope covers TP-Link Systems Inc. Aginet mesh extender and gateway models (HB210, HB410, HB610, HB710, HB810, HX141, HX220, HX510, HX710, EX141, EX220, EX222, EX511, EX520, EX520v, EX521, EX820v, EX920, HC220-G5, VX420-G2h, VX800v, VX1800v, XX230v, XX530v, XC220-G3v), all running pre-patch firmware versions documented in the EUVD advisory EUVD-2025-210673. The CVSS 4.0 vector specifies AV:A (adjacent-network), meaning the management interface is exploitable from the same LAN or Wi-Fi segment and is not directly reachable from arbitrary internet hosts under a typical home/SMB deployment.
RemediationAI
TP-Link has released patched firmware for all affected models; the fix is confirmed available per vendor advisory at https://www.tp-link.com/us/support/faq/5239/. Device owners should immediately apply the firmware update specific to their model and regional variant - exact fixed build strings per model are documented in EUVD-2025-210673 (e.g., HB810(US2) fixed in v6095.0 Build 260717 Rel.67188n, HB610(US2/CA/EU1) fixed in v60af.0 Build 251204 Rel.20362n, EX220 series fixed in v605f.0 Build 250305 Rel.14728n). As a compensating control while patching, administrators should restrict physical and wireless access to the LAN segment hosting these devices and disable Wi-Fi guest networks that share the same layer-2 segment as the management interface - doing so prevents adjacent-network exploitation by untrusted parties. If the device's management interface has been configured to be reachable from a WAN-facing interface, that exposure should be eliminated immediately by reverting to default LAN-only management access. Firmware updates can typically be applied through the Aginet mobile app or the device's web management portal.
More in Hb810 Us2 V1 0 1 6 2 0 2 6
View allOS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attac
Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privilege
Hardcoded cryptographic keys embedded in TP-Link Aginet firmware expose sensitive configuration data to any attacker who
Symlink traversal in TP-Link Aginet home networking devices exposes sensitive filesystem files to any attacker who can p
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today