Eb210 Pro Eu1 1 0
Monthly
OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines.
Hardcoded cryptographic keys embedded in TP-Link Aginet firmware expose sensitive configuration data to any attacker who gains access to device storage. Affecting over 70 distinct hardware SKUs across the HB, HX, HC, EB, EC, EX, XX, XC, and VX product families, the static keys are identical across all devices sharing a firmware image, meaning key material extracted from one device - or from a publicly downloadable firmware image - decrypts configuration stores on any other device of the same model. Successful exploitation yields plaintext credentials and service configuration, and no public exploit has been identified at time of analysis. TP-Link has released patched firmware for all affected models.
Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privileged users to invoke administrative operations - including creating privileged accounts and modifying critical configuration settings - by exploiting insufficient authorization validation (CWE-863). The flaw spans the HB, HX, EX, HC, EB, XX, VX, and XC device families in US, EU, BR, AU, CA, KR, DE, and RU regional variants, with specific vulnerable firmware builds documented per device in ENISA EUVD-2025-210674. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available at the TP-Link advisory.
OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines.
Hardcoded cryptographic keys embedded in TP-Link Aginet firmware expose sensitive configuration data to any attacker who gains access to device storage. Affecting over 70 distinct hardware SKUs across the HB, HX, HC, EB, EC, EX, XX, XC, and VX product families, the static keys are identical across all devices sharing a firmware image, meaning key material extracted from one device - or from a publicly downloadable firmware image - decrypts configuration stores on any other device of the same model. Successful exploitation yields plaintext credentials and service configuration, and no public exploit has been identified at time of analysis. TP-Link has released patched firmware for all affected models.
Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privileged users to invoke administrative operations - including creating privileged accounts and modifying critical configuration settings - by exploiting insufficient authorization validation (CWE-863). The flaw spans the HB, HX, EX, HC, EB, XX, VX, and XC device families in US, EU, BR, AU, CA, KR, DE, and RU regional variants, with specific vulnerable firmware builds documented per device in ENISA EUVD-2025-210674. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available at the TP-Link advisory.