TP-Link Aginet CVE-2025-30241

Two concrete prerequisites must be satisfied. First, the attacker must be on the same adjacent network as the device - connected to the same LAN switch, Wi-Fi SSID, or mesh backhaul network; internet-based remote exploitation is not possible given AV:A in the CVSS 4.0 vector. Second, the attacker must possess at least low-privilege authentication credentials for the device's web management interface (PR:L in CVSS 4.0); unauthenticated exploitation is not supported by the available data. Limiting factors include: the adjacency requirement significantly reduces the potential attacker population to entities already on the local network; low-privilege access is required, meaning stolen or default credentials are a prerequisite rather than optional; and the scope change metrics (SC:N/SI:N/SA:N) indicate that exploitation does not automatically spread to systems beyond the compromised device without additional attacker effort. Non-default or hardened configurations with strong credential policies and network segmentation materially raise the effective exploitation bar.

The CVSS 4.0 base score of 8.6 with AV:A/PR:L reflects two meaningful constraints: the attacker must already be present on the adjacent network (same LAN or Wi-Fi segment) and must hold at least low-privilege credentials on the device. These factors materially reduce the attack surface compared to an internet-facing, unauthenticated flaw. In a home environment, however, the adjacent-network requirement is often trivially satisfied - any device on the home Wi-Fi qualifies - and default or weak credentials are common on consumer devices, softening the PR:L barrier. No EPSS score was provided in the input data; no KEV listing and no public POC have been identified, indicating the vulnerability has not yet seen widespread active exploitation. The full C:H/I:H/A:H impact reflects that successful exploitation yields full device control, enabling persistent backdoors, traffic interception, lateral movement to adjacent LAN hosts, or use of the device as a pivot point. The primary real-world risk is concentrated in environments where Wi-Fi access is loosely controlled or shared credentials are reused across devices.

An attacker connected to the same Wi-Fi or LAN segment as an affected TP-Link Aginet device - for example, a malicious guest on a home network, a compromised IoT device, or an insider - authenticates to the device's web management interface using obtained or default credentials. The attacker then submits a crafted HTTP request to a vulnerable web interface component, embedding shell metacharacters (e.g., semicolons, backticks, or pipes) in a parameter that is passed unsanitized to a system command function. The injected command executes with elevated privileges, allowing the attacker to establish a persistent backdoor, exfiltrate Wi-Fi PSKs, or use the device as a network pivot. No public POC has been identified at time of analysis, but the vulnerability class (CWE-78) is well-understood and exploit development is straightforward once the vulnerable endpoint is identified.