Which versions of TP-Link Aginet are affected by CVE-2025-30238?

TP-Link Aginet mesh networking devices (60+ models spanning HB, HX, EX, HC, EB, XX, VX, and XC families) contain a privilege escalation vulnerability allowing authenticated low-privileged users to…. A patch is available.

How to fix or mitigate CVE-2025-30238?

Within 24 hours: Identify and catalog all TP-Link Aginet mesh devices in your environment (HB, HX, EX, HC, EB, XX, VX, XC families); cross-reference device models and current firmware versions against ENISA EUVD-2025-210674 to determine vulnerability status by regional variant. Within 7 days: Obtain vendor-released patch from TP-Link security advisory and deploy to all affected devices, beginning with production and management network segments. Within 30 days: Verify patch deployment across all inventory and audit administrative account creation and configuration changes within the vulnerability window to detect unauthorized modifications.

TP-Link Aginet CVE-2025-30238

Q: What is the CVSS score of CVE-2025-30238?

CVE-2025-30238 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-210674 HIGH

Incorrect Authorization (CWE-863)

2026-08-10 TPLink

GHSA-vhwm-f68v-4vg9

TP-Link Authentication Bypass Hb810 Us2 V1 0 1 6 2 0 2 6 Hb810 Eu1 V2 0 Hb710 Us2 V1 6 1 0 Hb710 Eu1 1 0 Hb610 Us2 V2 6 2 0 Hb610 Eu1 Hb610 Ca V2 0 Hb410 Eu1 1 0 Hb210 Us2 1 0 Hb210 Eu1 1 0 Hb210 Pro Eu1 1 0 Hb210 Pro Us2 1 0 1 6 Hx510 Us1 V2 0 Hx510 Eu1 V2 0 Hx510 Ca V1 0 2 0 Hx510 Au V1 0 2 0 Hx510 Us2 2 6 Hx710 Eu1 V1 0 Hx710 Pro Eu1 V1 0 Hx220 Us1 V1 0 1 0 Hx220 Eu1 V1 0 Hx220 Ca V1 0 Hx220 Au V1 0 Hx141 Eu1 V1 0 Hc220 G5 Us1 V1 0 1 6 Hc220 G5 Eu1 V1 20 1 0 Hc220 G5 Br V1 30 Eb210 Pro Eu1 1 0 Eb210 Pro Us1 1 0 Eb810V Eu1 V1 0 Ex141 Br V1 0 1 9 Ex141 Eu1 V1 0 Ex141 Us1 V1 0 Ex220 Br V1 0 1 20 1 28 1 29 1 8 Ex220 Br V2 0 Ex220 Eu1 V1 0 1 20 Ex220 Ru V1 0 Ex220 Us1 V1 0 Ex222 Eu1 V1 0 Ex222 Kr V1 0 Ex222 Us1 V1 0 Ex511 Br V2 0 2 8 2 9 Ex511 Eu1 V2 0 Ex511 Us1 V2 0 Ex520 Us1 V1 0 Ex520V Eu1 1 0 Ex521 Us1 V1 0 Ex820V Eu1 V1 0 Ex920 Us2 V1 6 V1 0 Xc220 G3V Eu1 V2 30 Xc220 G3V Us1 V2 30 Xx530V Br V1 0 Xx530V Br V2 0 Xx530V Us1 Xx530V Eu1 Xx230V Br V1 0 Vx800V De V1 0 Vx1800V Eu1 V1 0 Vx420 G2H Au V3 0

8.6

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

8.6 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Adjacent vector and low privilege required per description and CVSS 4.0 source; scope unchanged as impact is contained to the vulnerable device with no lateral system compromise indicated.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 23:23 vuln.today

Patch available

Aug 10, 2026 - 23:04 EUVD

CVE Published

Aug 10, 2026 - 22:24 cve.org

HIGH 8.6

DescriptionCVE.org

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations.

An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.

Articles & Coverage 1

News 4 New TP-Link Vulnerabilities - 4 High Severity, No Public POC Aug 11, 2026

AnalysisAI

Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privileged users to invoke administrative operations - including creating privileged accounts and modifying critical configuration settings - by exploiting insufficient authorization validation (CWE-863). The flaw spans the HB, HX, EX, HC, EB, XX, VX, and XC device families in US, EU, BR, AU, CA, KR, DE, and RU regional variants, with specific vulnerable firmware builds documented per device in ENISA EUVD-2025-210674. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available at the TP-Link advisory.

Technical ContextAI

The vulnerability is rooted in CWE-863 (Incorrect Authorization), where the Aginet firmware fails to enforce privilege-level checks before processing privileged management operations. CPE data confirms the affected scope spans TP-Link's Aginet line - an ISP-grade family including home hubs (HB series), WiFi mesh nodes (HX series), range extenders (EX series), cable gateways (HC220-G5), broadband ONTs (EB, EB810v), fiber and DSL devices (XX, VX series), and VDSL gateways (XC220-G3v). The flaw likely resides in the device web management API or backend daemon, where session tokens are authenticated but not validated against the required privilege tier before dispatching privileged actions such as account provisioning or configuration writes. The CVSS 4.0 adjacent attack vector (AV:A) indicates the management plane is reachable only from the local network segment, consistent with typical home gateway and ISP CPE architectures.

RemediationAI

The primary remediation is to update device firmware to the fixed versions specified in the TP-Link advisory at https://www.tp-link.com/us/support/faq/5239/. Fixed firmware builds are device-specific: for example, HB810(US2) V1.0/1.6/2.0/2.6 is remediated at firmware 0.9.0 3.2.2 (Build 260717), HX510(EU1) V2.0 at 0.14.0 3.0.0 (Build 250822), EX220(EU1) V1.0/1.20 at 0.20.0 2.0.0 (Build 250305), and HX710(EU1) V1.0 at 0.5.0 3.1.10 (Build 260511) - the complete per-device fix matrix is in EUVD-2025-210674. Where immediate firmware updates are not feasible, administrators should restrict the device management interface to a dedicated management VLAN or trusted host allowlist, limiting lateral reachability from untrusted adjacent segments; note this requires compatible network infrastructure and may disrupt remote management workflows. Additionally, disabling low-privilege user accounts if they are not operationally required removes the privilege-escalation prerequisite entirely for those deployments.