CVE-2025-30241

This is like having a smart intercom in your office that only lets in people who already have a key — but once someone with a key gets in, they can secretly reprogram the whole building's security system, not just open doors. Here, someone who's already logged into your router's settings page can trick it into running dangerous commands that hand them full control of the device.

This matters to you if you use any TP-Link Aginet mesh router or extender from the HB810, HB710, HB610, HB410, or HB210 model lines — check your exact model and version number against the list, since fixes differ by model. It only becomes a real risk if someone with a valid login (or who has gained one) is on your local network or WiFi, not from the open internet.

This issue is drawing sustained press and tracking attention tied to an incident, and it affects an entire line of TP-Link router models with a flaw that can hand an attacker full device control. There's no confirmed public exploit code yet, but given the sustained attention and the severity of what's possible (elevated-privilege command execution), treat this as something to fix now rather than wait on.

Confirm exposure by checking the exact model, region variant (US2/EU1/CA), and current firmware build against the fixed-version table — fixes are model-specific, not a single universal patch. Target the listed fixed firmware for your exact model (e.g., HB610(CA) V2.0 → 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n; HB210 Pro models have their own separate builds). There is no documented breaking-change note from the vendor advisory, but back up router configuration before updating as standard practice. As a temporary workaround if immediate patching isn't possible, restrict web admin access to trusted LAN devices only, disable remote/WAN administration, and rotate admin credentials. Not in CISA KEV, so there's no federal remediation deadline, but prioritize given sustained incident-related press coverage (actor: QTYF) and the full-privilege command execution impact. Monitor TP-Link's security advisories for additional affected model variants and watch for any future public exploit code release, which would substantially raise risk.

CWE-78 (OS Command Injection) in the web management interface of multiple TP-Link Aginet device models; attack vector is adjacent-network with authentication required (not remotely exploitable over the open internet without prior access). No public exploit code is on record and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. EPSS scoring places predicted exploitation likelihood in the lower range with a flat trend, though this is overridden in urgency terms by sustained incident-related press coverage. Exploitation requires an authenticated adjacent attacker but results in elevated-privilege arbitrary command execution, enabling full device compromise.