جزئیات آسیب‌پذیری
CVE-2025-30241
TP-Link Systems EB210 ProTP-Link Systems EB810vTP-Link Systems EX220TP-Link Systems EX222TP-Link Systems EX520vTP-Link Systems EX820v
OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices
CVSS 4.0
8.6بالا
شرح رسمی (انگلیسی)
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.6بالا | 4.0 | CVEProject cvelistV5 (CNA) (TPLink) | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| TP-Link Systems Inc. | EB210 Pro(EU1) 1.0 | v < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EB210 Pro(US1) 1.0 | v < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EB810v(EU1) V1.0 | v < 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(BR) V1.0/1.20/1.28/1.29/1.8 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(BR) V2.0 | v < 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(EU1) V1.0/1.20 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(RU) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(US1) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX222(EU1) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX222(KR) V1.0 | v < 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915 | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX222(US1) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX520v(EU1)1.0 | v < 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX820v(EU1) V1.0 | v < 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX920(US2) V1.6/V1.0 | v < 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210 Pro(EU1)1.0 | v < 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210 Pro(US2)1.0/1.6 | v < 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210(EU1) 1.0 | v < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210(US2) 1.0 | v < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB410( EU1) 1.0 | v < 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB610(CA) V2.0 | v < 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB610(EU1) | v < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB610(US2) V2.6/2.0 | v < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB710(EU1) 1.0 | v < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB710(US2) V1.6/1.0 | v < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB810(EU1) V2.0 | v < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB810(US2) V1.0/1.6/2.0/2.6 | v < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | VX420-G2h(AU) V3.0 | v < 0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | VX800v(DE) V1.0 | v < 800.0.16 | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX230v(BR) V1.0 | v < 0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX530v(BR)v2.0 | v < 0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX530v(EU1) | v < 0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱- https://www.tp-link.com/us/support/faq/5239/ vendor-advisory
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۵/۲۰
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۵/۲۱
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- TPLink
پیش‌بینی بهره‌برداری (EPSS)
۰٫۴٪
احتمال بهره‌برداری در ۳۰ روز
۳۵٫۳٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-78Improper neutralization of special elements used in an OS command ('OS command injection')