CVE-2025-30237

Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices

No known exploitation. EPSS puts it in the 25th percentile. Fixed versions are out.

CVSS —Not scored EPSS percentile25th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix5 products4 fixed builds listed below

Published 2026-08-10Updated 2026-10-09Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

TP-Link Systems Inc. HB810 V1.0/1.6/2.0/2.6Affected: < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188nUpgrade to: 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188nStated by: CVE record
TP-Link Systems Inc. HB810 V2.0Affected: < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567nUpgrade to: 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567nStated by: CVE record
TP-Link Systems Inc. HB710 V1.6/1.0Affected: < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956nUpgrade to: 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956nStated by: CVE record
TP-Link Systems Inc. HB710 1.0Affected: < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956nUpgrade to: 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956nStated by: CVE record
TP-Link Systems Inc. HB610 V2.6/2.0Affected: < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362nUpgrade to: 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362nStated by: CVE record

Versions as the sources state them. 51 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check the model and hardware/firmware version printed on the bottom of your device or in its admin panel against the affected list for this CVE.
If affected, log into the device's management interface and check for a pending firmware update, or download the correct build for your exact model/version from TP-Link's official support site.
Install the fixed firmware (version numbers differ per model — e.g. HB810(US2) needs Build 260717 Rel.67188n, HB210(US2) needs Build 250826 Rel.47715n; match your exact model/hardware version to the fix list).
Until updated, do not expose the device's web management interface to the internet and restrict access to trusted local devices only.
After updating, reboot the device and verify the new firmware version is active.

Usually a quick update

Coverage timeline

2 publishers

Exploitation reported in the wild
as reported · Oct 9, 2026·The Hacker News summary
Advisory coverage
as reported · Oct 8, 2026·SecurityWeek summary

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.

In plain language

Written by AI from the record

This is a serious flaw in several TP-Link Aginet mesh Wi-Fi devices that lets an attacker take full control of the device from the network without needing a password, and state-backed hacking groups have already been using TP-Link routers this way, so you should act now if you own one of these models.

Broken access control (CWE-862) on the web management interface of multiple TP-Link Aginet HB-series devices allows an unauthenticated, network-reachable attacker to invoke privileged administrative functions directly, and TP-Link routers have been documented as exploitation vectors in the Volt Typhoon and Flax Typhoon campaigns.

If you're affected

Full device takeover
Network traffic interception
Botnet/malware recruitment of device
Launchpad for internal network attacks
Operational disruption from device hijack

What is it

Think of this like a side door into your Wi-Fi router's control panel that doesn't require a key — anyone who can reach it over the network can walk in and act as the administrator, no password needed. Once inside, they can reconfigure the device, redirect your internet traffic, or use it as a foothold into the rest of your network. These devices are home/small-office mesh Wi-Fi units, so compromise means your network's front door is wide open.

Who is affected

This matters to you if you run any of the TP-Link Aginet HB210, HB410, HB610, HB710, or HB810 mesh Wi-Fi devices (in their various US2/EU1/CA hardware revisions). The flaw requires no account and no user interaction, so any device reachable on the network — especially one with its management interface exposed to the internet — is at risk.

How urgent is it

Attackers are already using TP-Link routers as an entry point in real-world state-sponsored campaigns (Volt Typhoon and Flax Typhoon), and this flaw requires no credentials to exploit, so treat it as actively dangerous rather than theoretical. This is not yet listed in CISA's known-exploited-vulnerabilities catalog, but the documented campaign activity against TP-Link devices means you should not wait for that listing before acting. Update affected devices now rather than deferring this to a routine maintenance cycle.

What to do — in detail

Confirm exposure by checking whether the web management interface of each affected device is reachable from outside the local network (it should not be) and by matching the exact model/hardware revision/current firmware build against TP-Link's advisory. Target the fixed build listed per model — e.g. HB810(US2) V1.0/1.6/2.0/2.6 → 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n; HB810(EU1) V2.0 → Build 260306 Rel.47567n; HB710(US2)/HB710(EU1) → Build 251128 Rel.43956n; HB610(US2)/HB610(EU1) → Build 251204 Rel.20362n; HB610(CA) V2.0 → Build 251216 Rel.46954n; HB410(EU1) → Build 250901 Rel.45574n; HB210(US2)/HB210(EU1) → Build 250826 Rel.47715n; HB210 Pro variants have their own builds listed separately. There is no documented breaking-change concern beyond a standard firmware upgrade via the admin UI or TP-Link app. As a temporary workaround if firmware cannot be applied immediately, disable remote/WAN access to the management interface and restrict LAN access via firewall/ACL to trusted administrative hosts only. No CISA KEV due date applies since this CVE is not currently listed in KEV, but given documented nation-state campaign use of TP-Link devices broadly, prioritize this above routine patch cycles. Monitor for unexpected admin account changes, new firmware pushed without your action, unusual outbound connections, or devices rebooting/behaving unexpectedly after the update window.

Technical context

Weakness: CWE-862 (Missing Authorization) on the device's web management interface, allowing unauthenticated, network-based invocation of privileged administrative functions (no authentication, no user interaction required). Exploit maturity: no public PoC code is currently on record and this CVE is not listed in CISA KEV; however, news reporting attributes real-world exploitation of TP-Link router devices generally to the Volt Typhoon and Flax Typhoon state-sponsored campaigns and to Chinese botnet infrastructure used for password-spraying, which per verdict precedence outweighs the EPSS predictive score. Attack vector is network-based with default-config reachability unconfirmed in the findings. Press attention is sustained due to incident-related coverage (actor tag: QTYF).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.