Loading story…
TP-Link disclosed multiple vulnerabilities in ISP-managed Aginet networking products, including mesh systems, routers, PON devices, and xDSL modems, with the most serious flaws enabling privileged control of affected devices. The issues include authentication bypass in the web management interface (CVE-2025-30237, CVSS 8.7), privilege escalation in user management (CVE-2025-30238, CVSS 8.6), hardcoded cryptographic keys that can expose sensitive configuration data (CVE-2025-30239, CVSS 8.5), and OS command injection in web interface components (CVE-2025-30241, CVSS 8.6). TP-Link said exploitation conditions vary by flaw, with some attacks requiring adjacent network access, valid credentials, or access to device storage, while others can be triggered through crafted unauthenticated requests.
TP-Link published fixed firmware versions for many country- and ISP-specific model variants and said remediation for ISP-managed devices will be coordinated through service providers. The vendor advised customers to update firmware through device management interfaces or companion applications, restrict access to web administration services, review privileges for unauthorized changes, and contact their ISP if patches are not yet available. Successful exploitation could allow attackers to execute arbitrary commands, create privileged accounts, alter critical settings, or recover embedded keys and decrypt protected data, potentially leading to full device compromise.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
A CVE record was published for CVE-2025-30241, an OS command injection vulnerability in TP-Link Aginet web interface components caused by improper input validation before system command execution. The record said an authenticated adjacent attacker could execute arbitrary commands with elevated privileges and potentially fully compromise devices.
A CVE record was published for CVE-2025-30239, describing sensitive data exposure in multiple TP-Link Aginet devices due to hardcoded cryptographic keys embedded in firmware. The record noted that attackers with access to device storage could recover keys and decrypt protected configuration data.
A CVE record was published for CVE-2025-30238, a privilege escalation vulnerability in TP-Link Aginet user management caused by insufficient authorization validation. The entry said authenticated low-privileged users could perform higher-privileged operations and linked to TP-Link's advisory.
A CVE record was published for CVE-2025-30237, an authentication bypass issue in TP-Link Aginet web management interfaces caused by inconsistent enforcement of authentication checks on certain endpoints. The entry documented high severity, affected product ranges, and referenced TP-Link's remediation advisory.
TP-Link disclosed multiple vulnerabilities affecting ISP-managed Aginet networking products, including CVE-2025-30237 through CVE-2025-30241, and provided remediation guidance plus fixed firmware versions for many affected models. The advisory said updates for ISP-managed devices would be coordinated through ISPs and advised users to check device interfaces or apps for firmware updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcetp-link.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TP-Link has disclosed and patched a high-severity authenticated command injection flaw, **CVE-2026-5509**, affecting **Archer BE450 v1** and **BE7200 v1** routers. The vulnerability in the web management interface carries a **CVSS 8.5** score and can let an attacker who has already gained administrative access execute arbitrary system commands, potentially leading to elevated privileges, configuration tampering, unauthorized service execution, and interception of sensitive network traffic. TP-Link said devices running firmware earlier than **`1.3.0 Build 20260416`** are vulnerable and urged customers to install the latest firmware from its regional support portals. The disclosure follows broader reporting on security weaknesses affecting **TP-Link Archer NX** routers, adding to concerns over exploitable flaws in the vendor’s consumer networking lineup. Together, the reports highlight continued risk in internet-facing router management functions, where compromised credentials or prior access can turn web interface bugs into full device compromise. Organizations and home users using affected Archer models should verify firmware versions, restrict administrative access, and apply vendor updates immediately.
Jun 29, 2026
TP-Link Archer `NX200`, `NX210`, `NX500`, and `NX600` routers are affected by two high-severity command injection vulnerabilities, tracked as **CVE-2025-15518** and **CVE-2025-15519**. The flaws stem from improper input handling in administrative CLI functions: one in a wireless-control command and the other in a modem-management command. In both cases, crafted input can be incorporated into operating system commands, enabling arbitrary command execution on the underlying device. The vulnerabilities require an authenticated attacker with administrative privileges, but successful exploitation could compromise the **confidentiality, integrity, and availability** of affected routers. Both issues are classified as `CWE-78` and were published as new CVE records with high-impact `CVSS v4.0` scoring. The CVE entries point users to TP-Link firmware download pages and support documentation for remediation guidance.
Jun 29, 2026
TP-Link has released security updates to address four critical vulnerabilities affecting its Omada gateway devices, with two of these flaws enabling remote code execution. The most severe of these vulnerabilities, CVE-2025-6542, carries a CVSS score of 9.3 and allows remote unauthenticated attackers to execute arbitrary commands on the device's underlying operating system. Another critical flaw, CVE-2025-6541, is an operating system command injection vulnerability that can be exploited by attackers with access to the web management interface. CVE-2025-7850, also with a CVSS score of 9.3, requires possession of an administrator password to exploit, but similarly allows arbitrary command execution. The fourth vulnerability, CVE-2025-7851, involves improper privilege management and could enable attackers to obtain a root shell under certain conditions. Affected models include ER8411, ER7412-M2, ER707-M2, ER7206, ER605, ER706W, ER706W-4G, ER7212PC, G36, G611, FR365, FR205, and FR307-M2, with specific firmware versions listed as vulnerable. TP-Link has advised all users of impacted devices to immediately update to the latest firmware versions to mitigate these risks. The company also recommends verifying device configurations after upgrading the firmware to ensure security settings remain intact. There is currently no evidence that these vulnerabilities have been exploited in the wild, but the critical nature of the flaws and the potential for remote, unauthenticated exploitation make prompt patching essential. The vulnerabilities could allow attackers to gain full control over affected devices, potentially enabling lateral movement within networks or use of the devices as a foothold for further attacks. The flaws were disclosed in a coordinated manner, and TP-Link responded by releasing patches and advisories to inform customers. Security researchers have highlighted the risk posed by these vulnerabilities, especially in environments where Omada gateways are used to manage network traffic and security. Organizations using these devices should prioritize patching and review their network segmentation to limit potential exposure. The vulnerabilities underscore the importance of regular firmware updates and strong administrative credential management for network infrastructure devices. TP-Link's advisory provides detailed instructions for identifying affected models and applying the necessary updates. The disclosure has prompted renewed attention to the security of network gateways and the need for ongoing vigilance in monitoring for new vulnerabilities. Security teams are urged to monitor for signs of compromise and to ensure that all network devices are included in vulnerability management programs. The incident serves as a reminder of the critical role that timely patching plays in defending against remote exploitation threats.
Jul 12, 2026