Multiple TP-Link Aginet Flaws Enable Auth Bypass, Privilege Escalation, and Command Injection

TP-Link disclosed multiple vulnerabilities in ISP-managed Aginet networking products, including mesh systems, routers, PON devices, and xDSL modems, with the most serious flaws enabling privileged control of affected devices. The issues include authentication bypass in the web management interface (CVE-2025-30237, CVSS 8.7), privilege escalation in user management (CVE-2025-30238, CVSS 8.6), hardcoded cryptographic keys that can expose sensitive configuration data (CVE-2025-30239, CVSS 8.5), and OS command injection in web interface components (CVE-2025-30241, CVSS 8.6). TP-Link said exploitation conditions vary by flaw, with some attacks requiring adjacent network access, valid credentials, or access to device storage, while others can be triggered through crafted unauthenticated requests.

TP-Link published fixed firmware versions for many country- and ISP-specific model variants and said remediation for ISP-managed devices will be coordinated through service providers. The vendor advised customers to update firmware through device management interfaces or companion applications, restrict access to web administration services, review privileges for unauthorized changes, and contact their ISP if patches are not yet available. Successful exploitation could allow attackers to execute arbitrary commands, create privileged accounts, alter critical settings, or recover embedded keys and decrypt protected data, potentially leading to full device compromise.