Loading vulnerability…
Authentication Bypass in TP-Link Aginet Web Management Interface
CVE-2025-30237 is an authentication bypass vulnerability affecting multiple TP-Link Aginet mesh systems, routers, PON devices, and xDSL modems. Missing authorization checks on certain web management endpoints allow unauthenticated requests to invoke privileged operations. The vulnerable authentication flow uses custom application-layer encryption over HTTP and HTTPS; an attacker can submit the initial login-format sign parameter containing an AES key and initialization vector alongside a data parameter carrying an arbitrary management action. This permits actions such as creating a Superadmin account and enabling SSH without valid credentials, potentially resulting in full device takeover. The vulnerability has a CVSS v4.0 score of 8.7.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated attacker can perform privileged management operations, create a Superadmin account, and enable SSH access. Successful exploitation can result in full device control, with high impact to device confidentiality, integrity, and availability. Arbitrary root-level command injection is tracked separately as CVE-2025-30241 and should not be conflated with this authentication bypass.
If you can’t patch tonight, do this now.
Restrict web management access to trusted administrative hosts or network segments, disable unnecessary remote management, and prevent untrusted clients from accessing the management interface. These measures reduce exposure but do not correct the authentication bypass. No vulnerability-specific workaround is listed; firmware updates remain necessary.
Patch, then assume compromise.
Install the fixed firmware applicable to the device's exact model, hardware revision, region, and ISP customization, as identified in TP-Link's security advisory. For ISP-managed Aginet devices, check the management interface or associated application for updates and contact the ISP if no update is available. ISP-specific firmware may be distributed only through provider-managed update mechanisms rather than public downloads.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.