Hb410 Eu1 1 0
Monthly
OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines.
Symlink traversal in TP-Link Aginet home networking devices exposes sensitive filesystem files to any attacker who can physically insert a prepared USB storage device. The firmware resolves symbolic links placed on external USB media without validating that the resolved path remains within the intended storage boundary, enabling unauthorized read access to device-internal files such as configuration and credential stores. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor has confirmed patches for all affected models.
Hardcoded cryptographic keys embedded in TP-Link Aginet firmware expose sensitive configuration data to any attacker who gains access to device storage. Affecting over 70 distinct hardware SKUs across the HB, HX, HC, EB, EC, EX, XX, XC, and VX product families, the static keys are identical across all devices sharing a firmware image, meaning key material extracted from one device - or from a publicly downloadable firmware image - decrypts configuration stores on any other device of the same model. Successful exploitation yields plaintext credentials and service configuration, and no public exploit has been identified at time of analysis. TP-Link has released patched firmware for all affected models.
Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privileged users to invoke administrative operations - including creating privileged accounts and modifying critical configuration settings - by exploiting insufficient authorization validation (CWE-863). The flaw spans the HB, HX, EX, HC, EB, XX, VX, and XC device families in US, EU, BR, AU, CA, KR, DE, and RU regional variants, with specific vulnerable firmware builds documented per device in ENISA EUVD-2025-210674. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available at the TP-Link advisory.
Authentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credentials to invoke privileged management operations and gain full administrative control of the device. The flaw (CWE-862, Missing Authorization) stems from inconsistent enforcement of access control checks on specific web management interface endpoints - certain privileged API handlers accept and act on requests without verifying caller identity. The vulnerability affects over 60 distinct model/region/hardware-revision combinations across the HB, HX, EX, HC, VX, and XX Aginet product lines; no public exploit code or CISA KEV listing is identified at time of analysis, but the vendor has released firmware patches.
OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines.
Symlink traversal in TP-Link Aginet home networking devices exposes sensitive filesystem files to any attacker who can physically insert a prepared USB storage device. The firmware resolves symbolic links placed on external USB media without validating that the resolved path remains within the intended storage boundary, enabling unauthorized read access to device-internal files such as configuration and credential stores. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor has confirmed patches for all affected models.
Hardcoded cryptographic keys embedded in TP-Link Aginet firmware expose sensitive configuration data to any attacker who gains access to device storage. Affecting over 70 distinct hardware SKUs across the HB, HX, HC, EB, EC, EX, XX, XC, and VX product families, the static keys are identical across all devices sharing a firmware image, meaning key material extracted from one device - or from a publicly downloadable firmware image - decrypts configuration stores on any other device of the same model. Successful exploitation yields plaintext credentials and service configuration, and no public exploit has been identified at time of analysis. TP-Link has released patched firmware for all affected models.
Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privileged users to invoke administrative operations - including creating privileged accounts and modifying critical configuration settings - by exploiting insufficient authorization validation (CWE-863). The flaw spans the HB, HX, EX, HC, EB, XX, VX, and XC device families in US, EU, BR, AU, CA, KR, DE, and RU regional variants, with specific vulnerable firmware builds documented per device in ENISA EUVD-2025-210674. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available at the TP-Link advisory.
Authentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credentials to invoke privileged management operations and gain full administrative control of the device. The flaw (CWE-862, Missing Authorization) stems from inconsistent enforcement of access control checks on specific web management interface endpoints - certain privileged API handlers accept and act on requests without verifying caller identity. The vulnerability affects over 60 distinct model/region/hardware-revision combinations across the HB, HX, EX, HC, VX, and XX Aginet product lines; no public exploit code or CISA KEV listing is identified at time of analysis, but the vendor has released firmware patches.