--- id: CVE-2025-30239 title: |- In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. … summary: |- In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. … severity: high cwe: - CWE-321 published: '2026-08-10' updated: '2026-10-09' sourceUpdated: '2026-10-09T17:16:40.853' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-30239' references: - url: 'https://www.tp-link.com/us/support/faq/5239/' label: f23511db-6c3e-4e32-a477-6aa17d310630 tags: - nvd - cve.org epss: 0.00198 epssPercentile: 0.0947 ingestedAt: '2026-09-29T11:32:41.226Z' vendor: TP-Link Systems Inc. product: HB810(US2) V1.0/1.6/2.0/2.6 affected: - hb810_us2_v1.0_1.6_2.0_2.6 < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n - hb810_eu1_v2.0 < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n - hb710_us2_v1.6_1.0 < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n - hb710_eu1_1.0 < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n - hb610_us2_v2.6_2.0 < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n - HB610(EU1) < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n - hb610_ca_v2.0 < 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n - hb410_eu1_1.0 < 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n - hb210_us2_1.0 < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n - hb210_eu1_1.0 < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n - hb210_pro_eu1_1.0 < 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n - hb210_pro_us2_1.0_1.6 < 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n - hx510_us1_v2.0 < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n - hx510_eu1_v2.0 < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n - hx510_ca_v1.0_2.0 < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n - hx510_au_v1.0_2.0 < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n - hx510_us2_2.6 < 0.17.0 3.2.2 v6065.0 Build 260722 Rel.10662n - hx710_eu1_v1.0 < 0.5.0 3.1.10 v6075.0 Build 260511 Rel.47847n - hx710_pro_eu1_v1.0 < 0.4.0 3.1.10 v6082.0 Build 260204 Rel.49460n - hx220_us1_v1.0_1.6 < 0.18.0 2.0.0 v605f.0 Build 260304 Rel.45905n - hx220_eu1_v1.0 < 0.18.0 2.0.0 v605f.0 Build 260304 Rel.45905n - hx220_ca_v1.0 < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n - hx220_au_v1.0 < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n - hx141_eu1_v1.0 < 1.2.0 3.1.0 v609d.0 Build 260128 Rel.29711n - hc220-g5_us1_v1.0_1.6 < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n - hc220-g5_eu1_v1.20_1.0 < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n - hc220-g5_br_v1.30 < 0.17.0 2.0.0 v605e.0 Build 250618 Rel.19329n - eb210_pro_eu1_1.0 < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n - eb210_pro_us1_1.0 < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n - eb810v_eu1_v1.0 < 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n - ec220-g5_br_v3.0 < 1.14.1 Build 250715 Rel.72650n(4252) - ec220-g5_eu1_v3.0 < 1.15.1 Build 260205 Rel.38208n(4555) - ec220-g5_us1_v3.0 < 1.14.1 Build 250715 Rel.72650n(4252) - ec225-g5_br_v1.0 < 1.14.1 Build 250717 Rel.34953n(4252) - ec225-g5_eu1_v1.0 < 1.14.1 Build 250711 Rel.35878n(4555) - ec225-g5_us1_v1.0 < 1.1.14.1 Build 250711 Rel.35607n(5553) - ex141_br_v1.0_1.9 < 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n - ex141_eu1_v1.0 < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n - ex141_us1_v1.0 < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n - >- ex220_br_v1.0_1.20_1.28_1.29_1.8 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n - ex220_br_v2.0 < 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n - ex220_eu1_v1.0_1.20 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n - ex220_ru_v1.0 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n - ex220_us1_v1.0 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n - ex222_eu1_v1.0 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n - ex222_kr_v1.0 < 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915 - ex222_us1_v1.0 < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n - ex511_br_v2.0_2.8_2.9 < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n - ex511_eu1_v2.0 < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n - ex511_us1_v2.0 < 0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n cvss: 8.5 cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N' ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-08-11T14:49:00.479124Z' cvssSource: cna --- ## Overview In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges.