CVE-2025-30238

Think of this like a hotel key card system where even a housekeeping staff card can be tricked into unlocking the manager's office and the safe. Anyone with even basic, limited access to your mesh network device can turn that into complete control — creating new admin accounts or changing critical settings without needing the real admin password.

This matters if you run any of the affected TP-Link Aginet mesh/router devices: HB810, HB710, HB610, HB410, HB210, or HB210 Pro series, in the specific firmware versions listed. It only becomes a risk if an attacker already has any login (even a low-privilege one) on the device — devices with no low-privilege accounts shared externally are at lower immediate risk, but default configurations are reachable.

Any user with only basic login access can escalate straight to full admin control, with no extra trick or interaction needed — that's a very low bar for an attacker to clear once they have any foothold. There's no confirmed report yet of this specific flaw being exploited in the wild, but TP-Link mesh and router devices have repeatedly been targeted by sophisticated state-linked hacking campaigns, and this class of easy privilege-escalation bug is exactly what such actors look for — treat this as urgent and patch now rather than wait for proof of active abuse.

Confirm exposure by identifying exact model and firmware build via the device admin panel (System Tools > firmware/version info) and cross-reference against the affected version table. Target fixed firmware per model: HB810(US2) → 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n; HB810(EU1) → 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n; HB710(US2/EU1) → 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n; HB610(US2/EU1) → 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n; HB610(CA) → 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n; HB410(EU1) → 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n; HB210(US2/EU1) → 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n; HB210 Pro(EU1) → 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n; HB210 Pro(US2) → 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n. There is no documented breaking-change note; apply firmware via standard OTA/web admin update flow. As a temporary workaround if patching must be delayed, remove or disable any non-essential low-privilege accounts and restrict admin panel access to trusted management networks only (do not expose the admin interface to the internet). This CVE is not in CISA KEV, so there is no federal remediation due date. Monitor for unexpected new admin accounts or configuration changes, and watch TP-Link's security advisories for updated builds covering additional models in this family.

Weakness: CWE-863 (Incorrect Authorization). Attack vector is network-based, requiring only low-privileged authenticated access with no user interaction, and the flaw is reachable in default configuration. No public exploit code is known, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; no dated news reporting ties active exploitation to this specific CVE, though TP-Link devices generally have been targeted by state-linked actors (e.g., Volt Typhoon) in unrelated campaigns, which has driven sustained press attention to the TP-Link Aginet product line. Exploit maturity is low (no PoC), and predicted exploitation likelihood is low, but confirmed ease of privilege escalation from any low-privilege account to full admin warrants prioritized patching regardless of predictive scoring.