EUVD-2025-210675
GHSA-9f5f-7wxj-73g8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector and low privileges reflect that storage access requires network adjacency or local foothold; C:H and I:H reflect full credential exposure enabling subsequent config tampering.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
3DescriptionCVE.org
In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data.
Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.
Articles & Coverage 1
AnalysisAI
Hardcoded cryptographic keys embedded in TP-Link Aginet firmware expose sensitive configuration data to any attacker who gains access to device storage. Affecting over 70 distinct hardware SKUs across the HB, HX, HC, EB, EC, EX, XX, XC, and VX product families, the static keys are identical across all devices sharing a firmware image, meaning key material extracted from one device - or from a publicly downloadable firmware image - decrypts configuration stores on any other device of the same model. Successful exploitation yields plaintext credentials and service configuration, and no public exploit has been identified at time of analysis. TP-Link has released patched firmware for all affected models.
Technical ContextAI
CWE-321 (Use of Hard-coded Cryptographic Key) describes the root cause: the Aginet firmware ships with a symmetric or asymmetric key baked into the binary to encrypt device configuration storage. Because the key is static rather than device-unique, an adversary can perform offline firmware analysis - either by acquiring a firmware image from TP-Link's own download portal or by reading device flash - to extract the key, then apply it to decrypt any configuration partition from any device running the same firmware build. The affected CPEs span a broad range of TP-Link home-mesh and Wi-Fi extender hardware (HB810, HB710, HB610, HB410, HB210, HX510, HX710, HX220, HX141, HC220-G5, EB210 Pro, EB810v, EC220-G5, EC225-G5, EX141, EX220, EX222, EX511, EX520, EX520v, EX521, EX820v, EX920, XC220-G3v, XX530v, XX230v, VX420-G2h, VX800v, VX1800v) across US, EU, BR, CA, AU, KR, RU, and DE regional variants. The CVSS 4.0 vector AV:A reflects that the primary attack surface is adjacent-network or local device access, while PR:L indicates the attacker needs at least a foothold on the device or its storage medium.
RemediationAI
Apply the vendor-released firmware updates for each affected model as documented in the TP-Link security advisory at https://www.tp-link.com/us/support/faq/5239/. Each model has a specific patched firmware build (see affected products above); update via the device's web management interface or the TP-Link Deco/Tether mobile application. Because hardcoded keys are a firmware-level flaw, no runtime configuration change can fully remediate the issue - key material embedded in older firmware images remains extractable even after a device is powered off. As an interim compensating control, restrict physical and shell access to the device: disable SSH or Telnet management interfaces if not needed, limit UART/JTAG exposure, and ensure the device is not reachable from untrusted network segments where an attacker could attempt to pivot onto it. After applying the patched firmware, rotate all credentials stored in device configuration (ISP passwords, Wi-Fi PSKs, admin passwords) as a precaution, since prior firmware may have stored those credentials under the compromised key scheme. Note that credential rotation addresses potential prior exposure but does not substitute for the firmware patch.
More in Hb810 Us2 V1 0 1 6 2 0 2 6
View allAuthentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credent
OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attac
Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privilege
Symlink traversal in TP-Link Aginet home networking devices exposes sensitive filesystem files to any attacker who can p
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today