vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-30238

Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices

HIGH
8.6
CVSS Score
Published: August 10, 2026 at 10:24 PM UTC
Updated: October 9, 2026 at 05:16 PM UTC
30 products affected across 2 vendorsVX800vVX1800vHB610

Using HB810(US2) V1.0/1.6/2.0/2.6 by TP-Link Systems Inc.?

Get instant alerts when new vulnerabilities affect HB810(US2) V1.0/1.6/2.0/2.6 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.6
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

VX1800v· TP-Link
90%
0
Affected range stops below 0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n, so it looks safe — our inference, not a vendor statement
EB210 Pro· TP-Link
90%
0
Affected range stops below 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n, so it looks safe — our inference, not a vendor statement
EB810v· TP-Link
90%
0
Affected range stops below 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n, so it looks safe — our inference, not a vendor statement
EX141· TP-Link
90%
0
Affected range stops below 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n, so it looks safe — our inference, not a vendor statement
EX220· TP-Link
90%
0
Affected range stops below 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n, so it looks safe — our inference, not a vendor statement
Affected range stops below 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n, so it looks safe — our inference, not a vendor statement
EX222· TP-Link
90%
0
Affected range stops below 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n, so it looks safe — our inference, not a vendor statement
Affected range stops below 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915, so it looks safe — our inference, not a vendor statement
EX511· TP-Link
90%
0
Affected range stops below 0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n, so it looks safe — our inference, not a vendor statement
Affected range stops below 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n, so it looks safe — our inference, not a vendor statement
EX520· TP-Link
90%
0
Affected range stops below 0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n, so it looks safe — our inference, not a vendor statement
EX520v· TP-Link
90%
0
Affected range stops below 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n, so it looks safe — our inference, not a vendor statement
EX521· TP-Link
90%
0
Affected range stops below 0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

Vendor Advisory
Source: cverecord
https://www.tp-link.com/us/support/faq/5239/

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.6HIGHTPLink
Vector?

Quick Info

StatusAWAITING ANALYSIS
CWE
CWE-863

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card