CVE-2025-30237
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
Risk Assessment
Risk of complete device takeover by an unauthenticated attacker, potentially leading to network and data security breaches.
Recommendation
Immediately update device firmware to fix authentication enforcement issues. Restrict management interface access to trusted networks.
Original NVD description (English source)
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.