CVE-2025-30240
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
TP-Link Aginet devices do not properly validate symbolic links on external USB storage. An attacker can place a crafted symlink on supported media, causing the system to resolve it, potentially allowing unauthorized read access to sensitive files.
Risk Assessment
An attacker with physical access to a USB port can gain access to sensitive system files, compromising data confidentiality and device integrity.
Recommendation
Apply TP-Link Aginet firmware updates that address this vulnerability. Restrict physical access to USB ports on devices.
Original NVD description (English source)
The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem.