---
id: CVE-2025-30238
title: >-
  In affected TP-Link Aginet devices, insufficient

  authorization validation allows authenticated low-privileged users to execute
  higher-privileged

  operations.






  An attacker

  may perform administrative actions such as creating privileged …
summary: >-
  In affected TP-Link Aginet devices, insufficient

  authorization validation allows authenticated low-privileged users to execute
  higher-privileged

  operations.






  An attacker

  may perform administrative actions such as creating privileged …
severity: high
cwe:
  - CWE-863
published: '2026-08-10'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T17:16:40.547'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-30238'
references:
  - url: 'https://www.tp-link.com/us/support/faq/5239/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
  - cve.org
epss: 0.00198
epssPercentile: 0.0947
ingestedAt: '2026-09-29T11:32:41.225Z'
vendor: TP-Link Systems Inc.
product: HB810(US2) V1.0/1.6/2.0/2.6
affected:
  - hb810_us2_v1.0_1.6_2.0_2.6 < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n
  - hb810_eu1_v2.0 < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n
  - hb710_us2_v1.6_1.0 < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
  - hb710_eu1_1.0 < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
  - hb610_us2_v2.6_2.0 < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
  - HB610(EU1) < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
  - hb610_ca_v2.0 < 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n
  - hb410_eu1_1.0 < 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n
  - hb210_us2_1.0 < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
  - hb210_eu1_1.0 < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
  - hb210_pro_eu1_1.0 < 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n
  - hb210_pro_us2_1.0_1.6 < 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n
  - hx510_us1_v2.0 < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
  - hx510_eu1_v2.0 < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
  - hx510_ca_v1.0_2.0 < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
  - hx510_au_v1.0_2.0 < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
  - hx510_us2_2.6 < 0.17.0 3.2.2 v6065.0 Build 260722 Rel.10662n
  - hx710_eu1_v1.0 < 0.5.0 3.1.10 v6075.0 Build 260511 Rel.47847n
  - hx710_pro_eu1_v1.0 < 0.4.0 3.1.10 v6082.0 Build 260204 Rel.49460n
  - hx220_us1_v1.0_1.6 < 0.18.0 2.0.0 v605f.0 Build 260304 Rel.45905n
  - hx220_eu1_v1.0 < 0.18.0 2.0.0 v605f.0 Build 260304 Rel.45905n
  - hx220_ca_v1.0 < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
  - hx220_au_v1.0 < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
  - hx141_eu1_v1.0 < 1.2.0 3.1.0 v609d.0 Build 260128 Rel.29711n
  - hc220-g5_us1_v1.0_1.6 < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n
  - hc220-g5_eu1_v1.20_1.0 < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n
  - hc220-g5_br_v1.30 < 0.17.0 2.0.0 v605e.0 Build 250618 Rel.19329n
  - eb210_pro_eu1_1.0 < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n
  - eb210_pro_us1_1.0 < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n
  - eb810v_eu1_v1.0 < 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n
  - ex141_br_v1.0_1.9 < 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n
  - ex141_eu1_v1.0 < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n
  - ex141_us1_v1.0 < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n
  - >-
    ex220_br_v1.0_1.20_1.28_1.29_1.8 < 0.20.0 2.0.0 v605f.0 Build 250305
    Rel.14728n
  - ex220_br_v2.0 < 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n
  - ex220_eu1_v1.0_1.20 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
  - ex220_ru_v1.0 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
  - ex220_us1_v1.0 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
  - ex222_eu1_v1.0 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
  - ex222_kr_v1.0 < 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915
  - ex222_us1_v1.0 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
  - ex511_br_v2.0_2.8_2.9 < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n
  - ex511_eu1_v2.0 < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n
  - ex511_us1_v2.0 < 0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n
  - ex520_us1_v1.0 < 0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n
  - EX520v(EU1)1.0 < 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n
  - ex521_us1_v1.0 < 0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n
  - ex820v_eu1_v1.0 < 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n
  - ex920_us2_v1.6_v1.0 < 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n
  - xc220-g3v_eu1_v2.30 < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n
cvss: 8.6
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-11T14:23:04.042032Z'
cvssSource: cna
---

## Overview

In affected TP-Link Aginet devices, insufficient
authorization validation allows authenticated low-privileged users to execute higher-privileged
operations.





An attacker
may perform administrative actions such as creating privileged accounts or
modifying critical configuration settings.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.