جزئیات آسیبپذیری
CVE-2025-30237
TP-Link Systems EX141TP-Link Systems EX220TP-Link Systems EX222TP-Link Systems EX511TP-Link Systems EX520TP-Link Systems EX520v
Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices
CVSS 4.0
8.7بالا
شرح رسمی (انگلیسی)
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.7بالا | 4.0 | CVEProject cvelistV5 (CNA) (TPLink) | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
محصولات آسیبپذیر
| فروشنده | محصول | نسخهها | منبع |
|---|---|---|---|
| TP-Link Systems Inc. | EX141(BR) V1.0/1.9 | v < 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX141(EU1) V1.0 | v < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX141(US1) V1.0 | v < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(BR) V1.0/1.20/1.28/1.29/1.8 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(BR) V2.0 | v < 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(EU1) V1.0/1.20 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(RU) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(US1) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX222(EU1) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX222(KR) V1.0 | v < 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915 | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX222(US1) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX511(BR) V2.0/2.8/2.9 | v < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX511(EU1) V2.0 | v < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX511(US1) V2.0 | v < 0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX520(US1) V1.0 | v < 0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX520v(EU1)1.0 | v < 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX521(US1) V1.0 | v < 0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX820v(EU1) V1.0 | v < 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX920(US2) V1.6/V1.0 | v < 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210 Pro(EU1)1.0 | v < 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210 Pro(US2)1.0/1.6 | v < 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210(EU1) 1.0 | v < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210(US2) 1.0 | v < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB410( EU1) 1.0 | v < 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB610(CA) V2.0 | v < 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB610(EU1) | v < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB610(US2) V2.6/2.0 | v < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB710(EU1) 1.0 | v < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB710(US2) V1.6/1.0 | v < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB810(EU1) V2.0 | v < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB810(US2) V1.0/1.6/2.0/2.6 | v < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HC220-G5(BR) V1.30 | v < 0.17.0 2.0.0 v605e.0 Build 250618 Rel.19329n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HC220-G5(EU1) V1.20/1.0 | v < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HC220-G5(US1) V1.0/1.6 | v < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX141(EU1) V1.0 | v < 1.2.0 3.1.0 v609d.0 Build 260128 Rel.29711n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX220(AU) V1.0 | v < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX220(CA) V1.0 | v < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX220(EU1) V1.0 | v < 0.18.0 2.0.0 v605f.0 Build 260304 Rel.45905n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX220(US1) V1.0/1.6 | v < 0.18.0 2.0.0 v605f.0 Build 260304 Rel.45905n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX510(AU) V1.0/2.0 | v < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX510(CA) V1.0/2.0 | v < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX510(EU1) V2.0 | v < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX510(US1) V2.0 | v < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX510(US2) 2.6 | v < 0.17.0 3.2.2 v6065.0 Build 260722 Rel.10662n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX710 Pro(EU1) V1.0 | v < 0.4.0 3.1.10 v6082.0 Build 260204 Rel.49460n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX710(EU1) V1.0 | v < 0.5.0 3.1.10 v6075.0 Build 260511 Rel.47847n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | VX1800v(EU1) V1.0 | v < 0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | VX420-G2h(AU) V3.0 | v < 0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | VX800v(DE) V1.0 | v < 800.0.16 | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XC220-G3v(EU1) V2.30 | v < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XC220-G3v(US1) V2.30 | v < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX230v(BR) V1.0 | v < 0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX530v(BR)v1.0 | v < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX530v(BR)v2.0 | v < 0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX530v(EU1) | v < 0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX530v(US1) | v < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱- https://www.tp-link.com/us/support/faq/5239/ vendor-advisory
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیبپذیریهای تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۵/۲۰
- آخرین بهروزرسانی
- ۱۴۰۵/۰۷/۱۷
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- TPLink
پیشبینی بهرهبرداری (EPSS)
۰٫۳۳٪
احتمال بهرهبرداری در ۳۰ روز
۲۶٫۴٪
صدک (نسبت به همهی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهرهبرداری
- ندارد
- اثر فنی
- کامل
ضعفها (CWE)
- CWE-862Missing Authorization