Description
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication
checks are not consistently enforced on certain endpoints. An attacker can send
specially crafted requests to bypass authentication and directly invoke
privileged functionality without valid credentials. This issue arises from
improper enforcement of access control mechanisms on sensitive operations.





Successful
exploitation may allow an unauthenticated attacker to execute privileged
operations and gain full control of the device.
Published: 2026-08-10
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw allows an attacker to bypass authentication checks on certain web interface endpoints and invoke privileged operations without valid credentials, giving full control of the device. The vulnerability arises from improper enforcement of access control mechanisms on sensitive operations, which can lead to compromise of confidentiality, integrity, and availability.

Affected Systems

The vulnerability affects a wide range of TP‑Link Aginet devices. Specific models include EX141 (BR/EU1/US1) v1.0–v1.9, EX220 (BR/EU1) v1.0–v1.20/1.28/1.29/1.8/2.0, EX222 (EU1/KR/US1) v1.0, EX511 (BR/EU1/US1) v2.0–v2.9, EX520 (US1) v1.0, EX521 (US1) v1.0, EX820v (EU1) v1.0, EX920 (US2) v1.0–v1.6, HB210 (EU1/US2) v1.0–v1.6, HB410 (EU1) v1.0, HB610 (CA/EU1/US2) v2.0–v2.6, HB710 (EU1/US2) v1.0–v1.6, HB810 (EU1/US2) v1.0–v2.6, HC220‑G5 (BR/EU1/US1) v1.0–v1.30, HX141 (EU1) v1.0, HX220 (AU/CA/EU1/US1) v1.0, HX510 (AU/CA/EU1/US1/US2) v1.0–v2.6, HX710 (EU1) v1.0, VX1800v (EU1) v1.0, VX420‑G2h (AU) v3.0, VX800v (DE) v1.0, XC220‑G3v (EU1/US1) v2.30, XX230v (BR) v1.0, XX530v (BR/US1/EU1) v1.0–v2.0.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability that can lead to full device compromise. Because the attack vector is remote through the web management interface and no authentication is required, the EPSS score is not available but the absence of a KEV listing suggests that public exploitation may not yet be widespread; however, the risk remains high. The flaw directly bypasses authorization controls (CWE‑862), allowing unauthenticated users to invoke privileged operations that affect confidentiality, integrity, and availability of the device.

Generated by OpenCVE AI on August 10, 2026 at 23:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device firmware to the latest version that resolves the broken access control flaw (check the TP‑Link support site for available firmware releases).
  • Disable or restrict external access to the web management interface, for example by limiting management traffic to a trusted internal subnet or whitelisting specific IP addresses.
  • Implement network segmentation so that administrative traffic to the devices is isolated from general user traffic and protected by a dedicated firewall.
  • Continuously monitor device logs for unusual management activity and enforce strong administrative passwords on each device.

Generated by OpenCVE AI on August 10, 2026 at 23:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Tp-link
Tp-link aginet
Tp-link ex141(br) V1.0/1.9
Tp-link ex141(eu1) V1.0
Tp-link ex141(us1) V1.0
Tp-link ex220(br) V1.0/1.20/1.28/1.29/1.8
Tp-link ex220(br) V2.0
Tp-link ex220(eu1) V1.0/1.20
Tp-link ex220(ru) V1.0
Tp-link ex220(us1) V1.0
Tp-link ex222(eu1) V1.0
Tp-link ex222(kr) V1.0
Tp-link ex222(us1) V1.0
Tp-link ex511(br) V2.0/2.8/2.9
Tp-link ex511(eu1) V2.0
Tp-link ex511(us1) V2.0
Tp-link ex520(us1) V1.0
Tp-link ex520v(eu1)1.0
Tp-link ex521(us1) V1.0
Tp-link ex820v(eu1) V1.0
Tp-link ex920(us2) V1.6/v1.0
Tp-link hb210(eu1) 1.0
Tp-link hb210(us2) 1.0
Tp-link hb210 Pro(eu1)1.0
Tp-link hb210 Pro(us2)1.0/1.6
Tp-link hb410( Eu1) 1.0
Tp-link hb610(ca) V2.0
Tp-link hb610(eu1)
Tp-link hb610(us2) V2.6/2.0
Tp-link hb710(eu1) 1.0
Tp-link hb710(us2) V1.6/1.0
Tp-link hb810(eu1) V2.0
Tp-link hb810(us2) V1.0/1.6/2.0/2.6
Tp-link hc220-g5(br) V1.30
Tp-link hc220-g5(eu1) V1.20/1.0
Tp-link hc220-g5(us1) V1.0/1.6
Tp-link hx141(eu1) V1.0
Tp-link hx220(au) V1.0
Tp-link hx220(ca) V1.0
Tp-link hx220(eu1) V1.0
Tp-link hx220(us1) V1.0/1.0
Tp-link hx510(au) V1.0/2.0
Tp-link hx510(ca) V1.0/2.0
Tp-link hx510(eu1) V2.0
Tp-link hx510(us1) V2.0
Tp-link hx510(us2) 2.6
Tp-link hx710(eu1) V1.0
Tp-link hx710 Pro(eu1) V1.0
Tp-link vx1800v(eu1) V1.0
Tp-link vx420-g2h(au) V3.0
Tp-link vx800v(de) V1.0
Tp-link xc220-g3v(eu1) V2.30
Tp-link xc220-g3v(us1) V2.30
Tp-link xx230v(br) V1.0
Tp-link xx530v(br)v1.0
Tp-link xx530v(br)v2.0
Tp-link xx530v(eu1)
Tp-link xx530v(us1)
Vendors & Products Tp-link
Tp-link aginet
Tp-link ex141(br) V1.0/1.9
Tp-link ex141(eu1) V1.0
Tp-link ex141(us1) V1.0
Tp-link ex220(br) V1.0/1.20/1.28/1.29/1.8
Tp-link ex220(br) V2.0
Tp-link ex220(eu1) V1.0/1.20
Tp-link ex220(ru) V1.0
Tp-link ex220(us1) V1.0
Tp-link ex222(eu1) V1.0
Tp-link ex222(kr) V1.0
Tp-link ex222(us1) V1.0
Tp-link ex511(br) V2.0/2.8/2.9
Tp-link ex511(eu1) V2.0
Tp-link ex511(us1) V2.0
Tp-link ex520(us1) V1.0
Tp-link ex520v(eu1)1.0
Tp-link ex521(us1) V1.0
Tp-link ex820v(eu1) V1.0
Tp-link ex920(us2) V1.6/v1.0
Tp-link hb210(eu1) 1.0
Tp-link hb210(us2) 1.0
Tp-link hb210 Pro(eu1)1.0
Tp-link hb210 Pro(us2)1.0/1.6
Tp-link hb410( Eu1) 1.0
Tp-link hb610(ca) V2.0
Tp-link hb610(eu1)
Tp-link hb610(us2) V2.6/2.0
Tp-link hb710(eu1) 1.0
Tp-link hb710(us2) V1.6/1.0
Tp-link hb810(eu1) V2.0
Tp-link hb810(us2) V1.0/1.6/2.0/2.6
Tp-link hc220-g5(br) V1.30
Tp-link hc220-g5(eu1) V1.20/1.0
Tp-link hc220-g5(us1) V1.0/1.6
Tp-link hx141(eu1) V1.0
Tp-link hx220(au) V1.0
Tp-link hx220(ca) V1.0
Tp-link hx220(eu1) V1.0
Tp-link hx220(us1) V1.0/1.0
Tp-link hx510(au) V1.0/2.0
Tp-link hx510(ca) V1.0/2.0
Tp-link hx510(eu1) V2.0
Tp-link hx510(us1) V2.0
Tp-link hx510(us2) 2.6
Tp-link hx710(eu1) V1.0
Tp-link hx710 Pro(eu1) V1.0
Tp-link vx1800v(eu1) V1.0
Tp-link vx420-g2h(au) V3.0
Tp-link vx800v(de) V1.0
Tp-link xc220-g3v(eu1) V2.30
Tp-link xc220-g3v(us1) V2.30
Tp-link xx230v(br) V1.0
Tp-link xx530v(br)v1.0
Tp-link xx530v(br)v2.0
Tp-link xx530v(eu1)
Tp-link xx530v(us1)

Tue, 11 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 10 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Description The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
Title Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Tp-link Aginet Ex141(br) V1.0/1.9 Ex141(eu1) V1.0 Ex141(us1) V1.0 Ex220(br) V1.0/1.20/1.28/1.29/1.8 Ex220(br) V2.0 Ex220(eu1) V1.0/1.20 Ex220(ru) V1.0 Ex220(us1) V1.0 Ex222(eu1) V1.0 Ex222(kr) V1.0 Ex222(us1) V1.0 Ex511(br) V2.0/2.8/2.9 Ex511(eu1) V2.0 Ex511(us1) V2.0 Ex520(us1) V1.0 Ex520v(eu1)1.0 Ex521(us1) V1.0 Ex820v(eu1) V1.0 Ex920(us2) V1.6/v1.0 Hb210(eu1) 1.0 Hb210(us2) 1.0 Hb210 Pro(eu1)1.0 Hb210 Pro(us2)1.0/1.6 Hb410( Eu1) 1.0 Hb610(ca) V2.0 Hb610(eu1) Hb610(us2) V2.6/2.0 Hb710(eu1) 1.0 Hb710(us2) V1.6/1.0 Hb810(eu1) V2.0 Hb810(us2) V1.0/1.6/2.0/2.6 Hc220-g5(br) V1.30 Hc220-g5(eu1) V1.20/1.0 Hc220-g5(us1) V1.0/1.6 Hx141(eu1) V1.0 Hx220(au) V1.0 Hx220(ca) V1.0 Hx220(eu1) V1.0 Hx220(us1) V1.0/1.0 Hx510(au) V1.0/2.0 Hx510(ca) V1.0/2.0 Hx510(eu1) V2.0 Hx510(us1) V2.0 Hx510(us2) 2.6 Hx710(eu1) V1.0 Hx710 Pro(eu1) V1.0 Vx1800v(eu1) V1.0 Vx420-g2h(au) V3.0 Vx800v(de) V1.0 Xc220-g3v(eu1) V2.30 Xc220-g3v(us1) V2.30 Xx230v(br) V1.0 Xx530v(br)v1.0 Xx530v(br)v2.0 Xx530v(eu1) Xx530v(us1)
cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published:

Updated: 2026-08-11T14:23:49.823Z

Reserved: 2025-03-19T11:09:33.244Z

Link: CVE-2025-30237

cve-icon Vulnrichment

Updated: 2026-08-11T14:23:47.127Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-10T23:16:48.640

Modified: 2026-08-18T15:04:46.610

Link: CVE-2025-30237

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T14:21:32Z

Weaknesses