TP-Link Aginet CVE-2025-30239

Exploitation requires two prerequisites: first, access to the firmware binary containing the hardcoded key (obtainable from TP-Link's public firmware download pages without authentication); second, read access to the target device's configuration storage, which requires either physical flash access (removing and reading the flash chip or using a UART/JTAG debug port), a local authenticated shell on the device, or a prior network compromise of the device that grants filesystem access. The CVSS 4.0 vector AV:A/PR:L confirms adjacent-network positioning and at least low-privilege access are required for the storage-read phase. Exploitation is limited by the requirement for either physical device access or a prior compromise; this is not a remotely unauthenticated attack. The vulnerability does not require any special device feature to be enabled - the hardcoded key is present in all affected firmware builds by default - but the attacker must still bridge the physical or network access gap to retrieve the encrypted configuration data from a specific device.

The CVSS 4.0 score of 8.5 with AV:A/PR:L reflects a meaningful but access-gated risk. The adjacent-network attack vector and requirement for storage access (physical flash read, UART shell, or prior network compromise) significantly constrain opportunistic exploitation - this is not a remotely unauthenticated attack against default configurations. However, the hardcoded-key class of vulnerability is particularly pernicious because the key is identical across the entire fleet of a given model: extracting it once breaks encryption on every deployed unit globally. TP-Link firmware images are frequently available for public download, meaning the key extraction phase may not require physical device access at all; only obtaining the specific device's encrypted configuration partition requires adjacency or physical access. No KEV listing and no public exploit code are identified, keeping real-world exploitation risk moderate rather than critical. The VC:H/VI:H impact ratings are well-founded given that decrypted configuration typically contains ISP credentials, Wi-Fi PSKs, and admin passwords. EPSS data was not provided; given no public PoC, exploit probability is likely low-to-moderate. The primary risk scenario is targeted post-compromise credential harvesting rather than mass exploitation.

An attacker who has acquired a copy of the affected TP-Link firmware image - downloadable from the vendor's public support portal - performs static analysis to locate and extract the hardcoded symmetric key from the firmware binary. The attacker then gains physical or local shell access to a target device (for example, via a compromised home network, UART console, or direct flash-chip read), dumps the configuration partition, and applies the extracted key to decrypt it in full, recovering plaintext Wi-Fi credentials, ISP account passwords, and the device admin password. No public exploit code for this specific CVE has been identified at time of analysis.