Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices

Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.

What is CVE-2025-30238?

CVE-2025-30238 is a vulnerability classified as Incorrect Authorization, affecting HB810(US2) V1.0/1.6/2.0/2.6 (affected versions: < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n), HB810(EU1) V2.0 (affected versions: < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n), HB710(US2) V1.6/1.0 (affected versions: < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n), and 56 more products. This vulnerability is rated High, with a CVSS score of 8.6. Current sources do not report this vulnerability as exploited.

Analyzing data...

Overview

Original source data

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations.

An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.

Affected products and scope

The analysis could not be completed. The original vulnerability data remains available below.

Technical details

The analysis could not be completed. The original vulnerability data remains available below.

Exploitability

The analysis could not be completed. The original vulnerability data remains available below.

Technical impact

The analysis could not be completed. The original vulnerability data remains available below.

Business impact

The analysis could not be completed. The original vulnerability data remains available below.

Remediation

The analysis could not be completed. The original vulnerability data remains available below.

Detection

The analysis could not be completed. The original vulnerability data remains available below.

Sources (6)

GCVE / Vulnerability-Lookup

TPLink (CNA)

High

Provider: TP-Link Systems Inc.
Primary affected product: HB810(US2) V1.0/1.6/2.0/2.6
Affected versions: 0 – < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n
Published: 08/10/2026

Exploitation status: Not known exploited

Estimated exploitation probability (EPSS): 0.14%
Remote initial access: —

Classification: CWE-863— Incorrect Authorization
Equivalent IDs: GHSA-vhwm-f68v-4vg9
Fix: Fix available

CVSS2

(Not available)

Attack complexity: —
Attack vector: —
Confidentiality impact: —
Integrity impact: —
Privileges required: —
User interaction required: —

CVSS3

(Not available)

Attack complexity: —
Attack vector: —
Confidentiality impact: —
Integrity impact: —
Privileges required: —
User interaction required: —

CVSS4

(CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)

Attack complexity: Low
Attack vector: Adjacent
Confidentiality impact: High
Integrity impact: High
Privileges required: Low
User interaction required: None

Learn more

Run an in-depth assessment with complete web risk management

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.

Explore CyStack VulnScan

Explore other related solutions

HB810(US2) V1.0/1.6/2.0/2.6

TP-Link Systems Inc.

HB810(EU1) V2.0

TP-Link Systems Inc.

HB710(US2) V1.6/1.0

TP-Link Systems Inc.

View all security vulnerabilities