Vulnerability details
CVE-2025-30237
TP-Link Systems EX141TP-Link Systems EX220TP-Link Systems EX222TP-Link Systems EX511TP-Link Systems EX520TP-Link Systems EX520v
Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices
CVSS 4.0
8.7High
Official description
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (TPLink) | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| TP-Link Systems Inc. | EX141(BR) V1.0/1.9 | v < 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX141(EU1) V1.0 | v < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX141(US1) V1.0 | v < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(BR) V1.0/1.20/1.28/1.29/1.8 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(BR) V2.0 | v < 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(EU1) V1.0/1.20 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(RU) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX220(US1) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX222(EU1) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX222(KR) V1.0 | v < 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915 | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX222(US1) V1.0 | v < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX511(BR) V2.0/2.8/2.9 | v < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX511(EU1) V2.0 | v < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX511(US1) V2.0 | v < 0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX520(US1) V1.0 | v < 0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX520v(EU1)1.0 | v < 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX521(US1) V1.0 | v < 0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX820v(EU1) V1.0 | v < 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | EX920(US2) V1.6/V1.0 | v < 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210 Pro(EU1)1.0 | v < 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210 Pro(US2)1.0/1.6 | v < 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210(EU1) 1.0 | v < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB210(US2) 1.0 | v < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB410( EU1) 1.0 | v < 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB610(CA) V2.0 | v < 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB610(EU1) | v < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB610(US2) V2.6/2.0 | v < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB710(EU1) 1.0 | v < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB710(US2) V1.6/1.0 | v < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB810(EU1) V2.0 | v < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HB810(US2) V1.0/1.6/2.0/2.6 | v < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HC220-G5(BR) V1.30 | v < 0.17.0 2.0.0 v605e.0 Build 250618 Rel.19329n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HC220-G5(EU1) V1.20/1.0 | v < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HC220-G5(US1) V1.0/1.6 | v < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX141(EU1) V1.0 | v < 1.2.0 3.1.0 v609d.0 Build 260128 Rel.29711n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX220(AU) V1.0 | v < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX220(CA) V1.0 | v < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX220(EU1) V1.0 | v < 0.18.0 2.0.0 v605f.0 Build 260304 Rel.45905n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX220(US1) V1.0/1.6 | v < 0.18.0 2.0.0 v605f.0 Build 260304 Rel.45905n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX510(AU) V1.0/2.0 | v < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX510(CA) V1.0/2.0 | v < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX510(EU1) V2.0 | v < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX510(US1) V2.0 | v < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX510(US2) 2.6 | v < 0.17.0 3.2.2 v6065.0 Build 260722 Rel.10662n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX710 Pro(EU1) V1.0 | v < 0.4.0 3.1.10 v6082.0 Build 260204 Rel.49460n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | HX710(EU1) V1.0 | v < 0.5.0 3.1.10 v6075.0 Build 260511 Rel.47847n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | VX1800v(EU1) V1.0 | v < 0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | VX420-G2h(AU) V3.0 | v < 0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | VX800v(DE) V1.0 | v < 800.0.16 | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XC220-G3v(EU1) V2.30 | v < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XC220-G3v(US1) V2.30 | v < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX230v(BR) V1.0 | v < 0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX530v(BR)v1.0 | v < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX530v(BR)v2.0 | v < 0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX530v(EU1) | v < 0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | XX530v(US1) | v < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://www.tp-link.com/us/support/faq/5239/ vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-11
- Last updated
- 2026-10-09
- State
- Published
- Assigner (CNA)
- TPLink
Exploit prediction (EPSS)
0.33%
Probability of exploitation in 30 days
26.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-862Missing Authorization