CVE-2025-30239

Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices

No known exploitation. EPSS puts it in the 9th percentile. Fixed versions are out.

CVSS —Not scored EPSS percentile9th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix5 products4 fixed builds listed below

Published 2026-08-10Updated 2026-10-09Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

TP-Link Systems Inc. HB810 V1.0/1.6/2.0/2.6Affected: < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188nUpgrade to: 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188nStated by: CVE record
TP-Link Systems Inc. HB810 V2.0Affected: < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567nUpgrade to: 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567nStated by: CVE record
TP-Link Systems Inc. HB710 V1.6/1.0Affected: < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956nUpgrade to: 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956nStated by: CVE record
TP-Link Systems Inc. HB710 1.0Affected: < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956nUpgrade to: 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956nStated by: CVE record
TP-Link Systems Inc. HB610 V2.6/2.0Affected: < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362nUpgrade to: 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362nStated by: CVE record

Versions as the sources state them. 60 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check your router's model and hardware/firmware version (printed on the device label or in its admin page) against the affected list: HB810, HB710, HB610, HB410, HB210 series.
Log in to the router's management interface and check for a firmware update notification.
Install the fixed firmware build for your exact model (for example, HB810(US2) V1.0/1.6/2.0/2.6 → version 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n; each model/region has its own specific fixed build, see the patch details).
If no update is available yet for your exact model, restrict physical access to the device and disable any remote management features until you can update.
After updating, change the router's admin password and any Wi-Fi passwords as a precaution.

Usually a quick update

What it is

From the CVE record

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.

In plain language

Written by AI from the record

Several TP-Link Aginet home/business routers store sensitive settings using a fixed, unchangeable secret code built into their software, so if someone gets physical or remote access to the device's storage, they can unlock stored credentials and configuration data — if you use one of these router models, you should update its software now.

CWE-321 hardcoded cryptographic key use in multiple TP-Link Aginet router firmware lines allows an attacker with physical or filesystem access to extract the static key and decrypt stored configuration data, including credentials.

If you're affected

Exposure of stored router credentials
Exposure of network configuration data
Device becomes pivot point for network
Botnet recruitment risk

What is it

Think of this like a safe that uses the exact same combination in every unit the factory makes, instead of letting you set your own. If someone can get inside the safe's housing (the router's storage), they already know the combination and can open it to read what's locked inside — in this case, saved passwords and network settings.

Who is affected

This matters to you if you run any of the following TP-Link Aginet router models: HB810, HB710, HB610, HB410, or HB210 (in their US2, EU1, or CA hardware variants). This is a risk mainly if someone can physically access the device or extract its firmware/filesystem — it is not something a remote internet attacker can trigger without that access.

How urgent is it

Routers from this vendor family have a documented history of being targeted by large-scale state-linked botnet campaigns, and no clean fix exists until you install the patched firmware for your exact model — this is why immediate action is warranted even though no attack specifically using this flaw has been confirmed yet. Treat any device holding sensitive credentials as a priority to update now rather than wait, since exploitation of TP-Link hardware in general has repeatedly become a real-world problem once a weakness is public.

What to do — in detail

Inventory all Aginet-branded TP-Link devices on your network and record the exact model, region variant, and current firmware build.
Compare each device's build string against the vendor's fixed builds (these are model-specific; e.g., HB610(US2) V2.6/2.0 → 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n, HB210(US2) 1.0 → 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n — use the full matrix provided by the vendor advisory).
Apply the firmware update via the vendor's official update mechanism; there are no reported breaking changes, but back up configuration before updating as a precaution.
Until updated, minimize physical exposure of the device (secure placement, no handoff of hardware to untrusted parties) and disable any debug/console access points, since exploitation requires storage/filesystem access.
No CISA KEV listing and no confirmed in-the-wild exploitation exist for this specific CVE at this time; there is no CISA remediation deadline to track for it.
Monitor vendor advisories for this device family going forward, given the sustained press and legal attention on TP-Link's broader security practices.

Technical context

Weakness: CWE-321 (Use of Hardcoded Cryptographic Key). Attack vector is local, requiring physical access or firmware/filesystem extraction; no authentication bypass or user interaction is needed once that access is obtained. No public exploit code is on record and this CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Press coverage (sustained, tied to lawsuits against TP-Link and historical Volt Typhoon/Flax Typhoon references) concerns the vendor's security practices broadly, not confirmed exploitation of this specific CVE. Predicted exploitation likelihood is low per EPSS modeling, consistent with the local-access precondition limiting mass remote exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.