Loading vulnerability…
Authenticated OS Command Injection in TP-Link Aginet Web Interface
CVE-2025-30241 is an operating-system command injection vulnerability in the web management interface of multiple TP-Link Aginet devices. Certain components pass user-controlled input to system-level command execution functions without adequate validation or sanitization. Identified injection points include the USB sharing-account password and WireGuard VPN account username. An authenticated attacker on an adjacent network can submit crafted input to execute arbitrary commands as root, potentially compromising the entire device.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises device confidentiality, integrity, and availability through root-level command execution. An attacker can access sensitive device data, alter configuration and system state, and disrupt operation. The vulnerability is rated High, with a CVSS 4.0 base score of 8.6.
If you can’t patch tonight, do this now.
Until patched firmware is installed, restrict web management access to trusted administrative hosts or networks, disable unnecessary remote management, use strong administrative credentials, and prevent untrusted users from accessing the management network. These measures reduce exposure but do not correct the command injection vulnerability; no complete workaround is documented.
Patch, then assume compromise.
Install the patched firmware applicable to the exact device model, hardware revision, region, and ISP customization identified in TP-Link's security advisory. Check the device management interface or associated management application for updates. For ISP-managed devices, obtain the applicable update through the service provider; contact the ISP if no update is available, since customized firmware may not be publicly downloadable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.