Loading vulnerability…
Sensitive Configuration Exposure via Hardcoded Cryptographic Keys in TP-Link Aginet Devices
CVE-2025-30239 is a sensitive-data exposure vulnerability affecting multiple TP-Link Aginet mesh systems, routers, PON devices, and xDSL modems. Affected firmware protects default configurations, active configurations, and configuration backups using hardcoded symmetric cryptographic keys tied to the device model rather than individual devices. Default configurations and backups use DES-ECB, while active configurations use AES-128-CBC with static key material. An attacker who obtains encrypted configuration data and recovers the corresponding firmware-embedded keys can decrypt stored credentials and service settings.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Decrypted configurations can disclose device account passwords, Wi-Fi credentials, and sensitive service information. Depending on device configuration, active configurations and backups may also expose CWMP credentials used for ISP remote management. These disclosures can facilitate unauthorized access to the device, wireless network, or associated management services where the recovered credentials are accepted. The vulnerability does not itself provide arbitrary code execution.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Pending firmware updates, restrict access to device storage and configuration backups, limit management-interface access to trusted administrators, disable unnecessary remote management, and prevent untrusted physical access. These controls reduce opportunities to obtain encrypted configuration data but do not correct the hardcoded-key weakness.
Patch, then assume compromise.
Install the fixed firmware applicable to the exact device model, hardware revision, region, and ISP customization identified in TP-Link's security advisory. Check the device management interface or associated application for updates. ISP-managed devices may receive updates through provider-controlled mechanisms, and customized firmware may not be publicly downloadable; contact the ISP if no update is available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.