Loading vulnerability…
Privilege Escalation in TP-Link Aginet User Management
CVE-2025-30238 is an incorrect authorization vulnerability in the user-management and web-management functions of multiple TP-Link Aginet devices. Insufficient authorization validation allows authenticated low-privileged users to submit management requests intended for administrators. Accessible operations include creating privileged accounts, modifying critical configuration, reading user and CWMP credentials, and enabling SSH or Telnet. An attacker can create a high-privileged account, enable SSH, and log in to take control of an affected device. The vulnerability is rated High with a CVSS v4.0 score of 8.6.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises device confidentiality, integrity, and availability by elevating a low-privileged management user to administrative control. Attackers can expose user and ISP remote-management credentials, create unauthorized privileged accounts, change critical settings, and enable remote-access services. Administrative configuration changes can disrupt device operation.
If you can’t patch tonight, do this now.
No complete workaround is documented. Until patched, restrict management-interface access to trusted administrative hosts or network segments, disable unnecessary remote management, and prevent untrusted users from reaching the management interface. Review and restrict user privileges, monitor for unauthorized account creation and configuration changes, and investigate unexpected activation of SSH or Telnet. These measures reduce exposure but do not correct the authorization flaw.
Patch, then assume compromise.
Install the fixed firmware designated for the exact device model, hardware revision, region, and ISP customization in TP-Link's security advisory. Firmware fixes are model-specific; no single fixed version applies to all affected devices. Check the device management interface or associated application for updates. For ISP-managed equipment, obtain the applicable update through the ISP and contact the provider if none is available; customized firmware may not be publicly downloadable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.