TP-Link Aginet CVE-2025-30237

Exploitation requires the attacker to be on the same local network segment (LAN or Wi-Fi) as the affected TP-Link Aginet device - the CVSS 4.0 AV:A metric confirms this adjacent-network constraint. No authentication is required (PR:N) and no user interaction is needed (UI:N). No special non-default configuration is required; the vulnerability exists in the default-enabled web management interface. The primary limiting factor is physical/network proximity: a remote internet attacker cannot exploit this unless the management interface is explicitly exposed to a WAN-facing interface, which is not the default deployment posture. Exploitation is further limited to the specific vulnerable firmware versions listed per model; devices already updated to the patched firmware builds are not affected.

The CVSS 4.0 score of 8.7 with vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H is internally consistent: low complexity, no authentication, no user interaction, and full CIA impact on the vulnerable device, but constrained to adjacent-network reach with no subsequent-system scope change. The adjacent-network requirement (AV:A) is the primary risk-reduction factor - an internet-based attacker cannot directly reach the management interface unless the device is misconfigured to expose it externally or is accessible via ISP bridge mode. In realistic deployments, exploitation requires the attacker to already be connected to the home LAN or Wi-Fi network, which materially limits opportunistic mass exploitation. EPSS data was not provided in the input; its absence means automated exploitation probability cannot be quantified. No CISA KEV listing and no known public exploit code are confirmed at time of analysis. However, the sheer breadth of affected models - spanning multiple hardware generations across North American, European, Brazilian, Korean, Australian, and Russian regional variants - means the aggregate exposed population is large. The low attack complexity (AC:L) and absence of any required precondition beyond network adjacency mean that exploitation, once the attacker is on-network, requires minimal skill. For home users whose guests or neighbors could reach the LAN, this represents a genuine elevated risk.

An attacker connected to the same home or office Wi-Fi network as a vulnerable TP-Link Aginet mesh node uses a network scanner to identify the device's management IP address, then crafts HTTP requests directly targeting privileged management endpoints - such as configuration reset, credential change, or remote-access enable - without supplying authentication tokens. Because the affected endpoints lack authorization enforcement, the device processes and executes the privileged commands, granting the attacker full administrative control. No public exploit code is confirmed at time of analysis, but the low attack complexity (AC:L) means exploitation requires only knowledge of the endpoint paths, which are likely consistent across firmware versions.