Which versions of TP-Link Aginet are affected by CVE-2025-30241?

TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) are vulnerable to OS command injection through the web interface, allowing authenticated users on the adjacent network to execute…. A patch is available.

How to fix or mitigate CVE-2025-30241?

Within 24 hours, audit network inventory for all TP-Link Aginet devices (HB, EB, EX, XX, VX series) and confirm patch version availability from TP-Link advisories. Within 7 days, begin staged firmware deployment starting with security-sensitive network segments, prioritizing devices accessible to multiple users or guest networks. Within 30 days, complete firmware updates across all affected units and verify remediation through automated inventory re-scan and device confirmation.

TP-Link Aginet CVE-2025-30241

Q: What is the CVSS score of CVE-2025-30241?

CVE-2025-30241 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2025-210677 HIGH

OS Command Injection (CWE-78)

2026-08-10 TPLink

GHSA-6v23-65fj-8g7c

Command Injection TP-Link Hb810 Us2 V1 0 1 6 2 0 2 6 Hb810 Eu1 V2 0 Hb710 Us2 V1 6 1 0 Hb710 Eu1 1 0 Hb610 Us2 V2 6 2 0 Hb610 Eu1 Hb610 Ca V2 0 Hb410 Eu1 1 0 Hb210 Us2 1 0 Hb210 Eu1 1 0 Hb210 Pro Eu1 1 0 Hb210 Pro Us2 1 0 1 6 Eb210 Pro Eu1 1 0 Eb210 Pro Us1 1 0 Eb810V Eu1 V1 0 Ex220 Br V1 0 1 20 1 28 1 29 1 8 Ex220 Br V2 0 Ex220 Eu1 V1 0 1 20 Ex220 Ru V1 0 Ex220 Us1 V1 0 Ex222 Eu1 V1 0 Ex222 Kr V1 0 Ex222 Us1 V1 0 Ex520V Eu1 1 0 Ex820V Eu1 V1 0 Ex920 Us2 V1 6 V1 0 Xx530V Br V2 0 Xx530V Eu1 Xx230V Br V1 0 Vx800V De V1 0 Vx420 G2H Au V3 0

8.6

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

8.6 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Adjacent vector and low-privilege authentication required per CVE description and CVSS 4.0 vendor vector; no scope change as device compromise is self-contained.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 23:21 vuln.today

Patch available

Aug 10, 2026 - 23:04 EUVD

CVE Published

Aug 10, 2026 - 22:26 cve.org

HIGH 8.6

DescriptionCVE.org

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges.

Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.

Articles & Coverage 1

News 4 New TP-Link Vulnerabilities - 4 High Severity, No Public POC Aug 11, 2026

AnalysisAI

OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines.

Technical ContextAI

CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes the root cause: certain web interface handlers pass user-supplied input directly or insufficiently sanitized to system-level functions such as exec(), popen(), or shell wrappers. The affected products span TP-Link's Aginet ecosystem - including HB-series mesh nodes (HB210, HB410, HB610, HB710, HB810), EB-series mesh extenders (EB210 Pro, EB810v), EX-series Wi-Fi range extenders (EX220, EX222, EX520v, EX820v, EX920), XX-series whole-home mesh units (XX230v, XX530v), and VX-series DSL routers (VX420-G2h, VX800v). CPE strings confirm affected hardware SKUs across US, EU, BR, CA, AU, DE, RU, and KR regional variants. The web interface runs with elevated system privileges, so injected commands inherit those privileges without additional escalation steps.

RemediationAI

The primary remediation is updating each affected device to its respective patched firmware build as documented in the TP-Link advisory at https://www.tp-link.com/us/support/faq/5239/. Specific fix builds are confirmed by EUVD-2025-210677 and include, for example, HB810(US2) firmware 0.9.0 3.2.2 Build 260717 and VX800v(DE) firmware 800.0.16; consult the advisory for the complete per-model table. Where immediate firmware update is not feasible, restrict access to the device management web interface to trusted hosts only by enabling access control lists or management ACLs if supported by the device. Changing default or weak device credentials reduces the exposure imposed by the PR:L requirement, as an attacker cannot exploit this without valid authentication. Isolating IoT/home networking devices on a dedicated VLAN or network segment limits the blast radius if exploitation occurs - an attacker would be constrained to that segment rather than the full LAN. Disabling remote management (if enabled) provides no direct mitigation since the vector is adjacent-network, not internet-facing, but is still a recommended hardening step. Note that VLAN isolation changes may affect mesh network functionality depending on how backhaul is configured on HB/EX/XX models.