TP-Link Aginet CVE-2025-30240

Physical access to the device's USB port is the non-negotiable prerequisite - the CVSS 4.0 vector is explicitly AV:P (Physical), confirming this is not remotely exploitable under any configuration. The attacker must prepare a USB storage device in advance with a crafted symbolic link targeting the desired internal path; this requires knowledge of the device's filesystem layout but no device credentials or authentication (PR:N). No user interaction is required from a device operator or administrator (UI:N) beyond the device being powered on with USB support active. Exploitation is strictly limited to read access on the vulnerable device's confidentiality (VC:H); there is no write or availability impact (VI:N/VA:N), and no subsequent-system scope change (SC:N/SI:N/SA:N). The primary factors limiting risk are: mandatory physical proximity, no network exploitability under any configuration, and read-only impact with no lateral movement vector from this vulnerability alone.

The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) anchors the dominant risk factor firmly: physical proximity is mandatory. Despite the High confidentiality impact on the vulnerable system, the physical access prerequisite eliminates remote or network-based exploitation entirely. No EPSS score was supplied, and neither a CISA KEV listing nor a public proof-of-concept was identified, leaving exploitation probability formally unknown but circumstantially low given the physical barrier. The 5.1 CVSS 4.0 score accurately reflects this balance. Even a mid-sized municipal IT team in gdynia managing a fleet of Aginet gateways should treat this as a secondary priority behind any remotely exploitable vulnerabilities, though it warrants remediation to address insider-threat and supply-chain USB attack scenarios. Scope is contained - no integrity write path and no subsequent-system impact - so lateral movement from this vulnerability alone is not indicated.

An attacker pre-stages a USB drive containing a crafted symbolic link - for example, a file named config.txt that actually points to /etc/config on the device filesystem - then briefly inserts the drive into a target TP-Link Aginet device's USB port, either during physical access to the premises or via a malicious USB device delivered through the supply chain. The firmware mounts the USB media and resolves the symlink transparently, making the contents of the device's internal config file readable through the USB interface without any authentication or network access. No public proof-of-concept has been identified, but the technique is well-understood and requires no specialized tooling beyond a standard USB drive and basic filesystem tools.