EUVD-2025-210676
GHSA-8vgw-m5fh-hwg3
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical insertion of USB media is required (AV:P); no privileges or interaction needed (PR:N/UI:N); impact is read-only confidentiality with no scope change (C:H/I:N/A:N/S:U).
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
2DescriptionCVE.org
The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link.
Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem.
AnalysisAI
Symlink traversal in TP-Link Aginet home networking devices exposes sensitive filesystem files to any attacker who can physically insert a prepared USB storage device. The firmware resolves symbolic links placed on external USB media without validating that the resolved path remains within the intended storage boundary, enabling unauthorized read access to device-internal files such as configuration and credential stores. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor has confirmed patches for all affected models.
Technical ContextAI
CWE-59 (Improper Link Resolution Before File Access, commonly called a 'Link Following' or symlink attack) describes the root cause: the Aginet firmware's USB storage mount logic follows symbolic links without first confirming the resolved path stays within the USB filesystem boundary. FAT and compatible filesystems support symlinks; an attacker pre-creates a symlink on the USB media pointing to an arbitrary path on the device's Linux root filesystem (e.g., /etc/config, /etc/passwd, or credential stores). When the device mounts the USB media, it resolves the link and exposes the linked target. CPE strings confirm the vulnerability spans at least ten distinct product families across multiple hardware revisions: HB210, HB410, HB610, HB710, HB810, EX220, EX222, EX520v, EX820v, EX920, EB810v, XC220-G3v, XX530v, VX420-G2h, VX800v, and VX1800v, covering US, EU, BR, RU, CA, AU, DE, and KR regional SKUs.
RemediationAI
Apply vendor-released firmware updates for each affected model as documented in TP-Link's advisory at https://www.tp-link.com/us/support/faq/5239/ and EUVD-2025-210676. Patched firmware builds have been released for all listed models; representative target versions include HB810(US2) firmware 0.9.0.3.2.2 v6095.0 Build 260717, HB810(EU1) firmware 0.10.0.3.2.2 v6095.0 Build 260306, and EX920(US2) firmware 0.8.0.3.2.2 v6080.0 Build 260309 - consult the advisory for the exact patched build for each model and region SKU. As a compensating control pending firmware deployment, implement physical security measures to prevent unauthorized access to device USB ports, such as locking equipment in network cabinets or applying USB port blockers where the management interface does not support disabling the USB feature in software. Note that physically blocking the USB port will also disable any legitimate USB storage functionality (such as shared storage or print server features) the device may support.
More in Hb810 Us2 V1 0 1 6 2 0 2 6
View allAuthentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credent
OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attac
Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privilege
Hardcoded cryptographic keys embedded in TP-Link Aginet firmware expose sensitive configuration data to any attacker who
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today