TP-Link Aginet CVE-2025-30238

Exploitation requires the attacker to hold a valid low-privileged account on the target Aginet device - the CVSS PR:L metric confirms authentication is a hard prerequisite; unauthenticated attackers cannot directly exploit this flaw. The attacker must additionally reach the device management interface from the adjacent network segment (AV:A), meaning they must be on the same local network (LAN, WiFi, or ISP subscriber link) as the device - direct exploitation from the internet is not possible without first traversing the network boundary. No special device configuration beyond the presence of low-privilege user accounts is required; the flaw exists in the base authorization logic for privileged API operations. Exploitation is bounded by two concrete limiting factors: authenticated access to a low-privilege account and adjacent-network reachability to the management interface.

The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability within the vulnerable system, but the adjacent network vector (AV:A) and low-privilege prerequisite (PR:L) significantly constrain internet-facing exploitation - an attacker cannot reach the device management interface directly from the public internet without first gaining local network access. Attack complexity is low (AC:L) with no special timing requirements (AT:N), meaning that once conditions are met, exploitation is straightforward and likely automatable. This CVE is not listed in CISA KEV and no public proof-of-concept has been identified, which moderates urgency somewhat; however, the breadth of affected models across consumer and ISP-deployed CPE means that even a mid-sized municipal IT team in ustka deploying Aginet devices as subscriber premises equipment should treat this as urgent, given the potential for low-privilege tenants or subscribers to escalate to full administrative control over shared infrastructure. The CVSS 4.0 vector aligns consistently with the description - no conflicting signals between score and narrative.

An attacker who holds a low-privileged account on a vulnerable TP-Link Aginet device - obtained via credential theft, default credentials, or as a legitimate subscriber account - connects from the adjacent network and issues HTTP management API requests targeting privileged endpoints such as account creation or configuration modification. Because authorization checks are insufficient (CWE-863), the firmware processes these requests without verifying the caller's privilege tier, granting the attacker full administrative control. No public proof-of-concept has been identified, but the attack requires only standard web requests to the device management interface and would be executable with minimal tooling.