CVE-2025-30240

Think of this like leaving a fake forwarding label on a mailbox: if someone plugs a specially crafted USB drive into one of these TP-Link devices, the device gets tricked into 'forwarding' requests to files it was never supposed to share, letting the attacker peek at internal data. It requires physical or local access to the USB port rather than a remote internet attack by itself.

This matters to you if you run any of the listed TP-Link Aginet device models (HB810, HB710, HB610, HB410, HB210, HB210 Pro series) in US2, EU1, or CA hardware variants. The risk is realistic mainly if untrusted USB storage devices can be connected to the unit, or if someone with physical or local network access to the device wants to pull sensitive files off it.

Fixes already exist for every affected model, and TP-Link networking devices as a category have drawn sustained attention from state-linked attacker groups, even though no public report has tied exploitation specifically to this flaw yet. Given that patches are ready and the vendor's devices are an active target class, treat this as something to fix now rather than defer.

Confirm exposure by identifying exact model and hardware version (e.g., HB810(US2) V2.6) and current firmware build via the admin UI or device label. Match against the fixed-version table: each model/variant has its own specific target build (e.g., HB710(US2) V1.6/1.0 → 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n; HB210(EU1) 1.0 → 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n). There is no documented workaround beyond restricting USB access — if patching is delayed, physically secure the USB port and disable auto-mount/auto-execute of USB content where configurable. No CISA KEV listing and no due date apply; EPSS is low and flat, and no public exploit code exists, so this is not yet under active opportunistic exploitation — but apply the vendor firmware update as routine but prompt maintenance given the device class's exposure history. Monitor TP-Link security advisories for this product line for any escalation.

CWE-59 (improper link resolution before file access / symlink following) in the USB-triggered HTTPS access path of TP-Link Aginet devices permits local/physical attackers to read arbitrary files via a crafted symbolic link on USB media. No public exploit code is known, this CVE is not in CISA's KEV catalog, and EPSS predicts low near-term exploitation likelihood (13th percentile, flat trend). Press attention around TP-Link routers generally (Volt Typhoon, Flax Typhoon campaigns) is sustained but not attributed to this specific CVE. Exploit maturity is low; attack vector is local (requires USB media access), limiting remote mass-exploitation potential. Vendor has issued per-model firmware fixes across twelve device/variant combinations.