CVE-2025-30241
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In certain TP-Link Aginet devices, web interface components do not properly validate and sanitize user-supplied input before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operating system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.
Risk Assessment
Risk of full device compromise by an authenticated attacker from the local network, potentially leading to data integrity and confidentiality breaches and disruption of device operation.
Recommendation
Apply firmware updates provided by the vendor that fix input validation. Restrict management interface access to trusted networks only.
Original NVD description (English source)
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.