OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices

Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.

What is CVE-2025-30241?

CVE-2025-30241 is a vulnerability classified as Improper Neutralization of Special Elements used in an OS Command, affecting HB810(US2) V1.0/1.6/2.0/2.6 (affected versions: < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n), HB810(EU1) V2.0 (affected versions: < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n), HB710(US2) V1.6/1.0 (affected versions: < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n), and 28 more products. This vulnerability is rated High, with a CVSS score of 8.6. Current sources do not report this vulnerability as exploited.

Overview

Original source data

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges.

Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.

Affected products and scope

The analysis could not be completed. The original vulnerability data remains available below.

Technical details

The analysis could not be completed. The original vulnerability data remains available below.

Exploitability

The analysis could not be completed. The original vulnerability data remains available below.

Technical impact

The analysis could not be completed. The original vulnerability data remains available below.

Business impact

The analysis could not be completed. The original vulnerability data remains available below.

Remediation

The analysis could not be completed. The original vulnerability data remains available below.

Detection

The analysis could not be completed. The original vulnerability data remains available below.

Sources (6)

GCVE / Vulnerability-Lookup

TPLink (CNA)

High

Provider: TP-Link Systems Inc.
Primary affected product: HB810(US2) V1.0/1.6/2.0/2.6
Affected versions: 0 – < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n
Published: 08/10/2026

Exploitation status: Not exploited
Patch status: Fix available
CISA KEV date: -
CISA KEV due date: -

Estimated exploitation probability (EPSS): 0.00409
Estimated exploitation percentile: 34.98%
Attack capability: Adjacent network

Products using this technology (0): -

Classification: CWE-78
Equivalent IDs: GHSA-6v23-65fj-8g7c

View details

/GHSA-6v23-65fj-8g7c

CVSS4

(CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)

Attack complexity: Low
Attack vector: Adjacent
Confidentiality impact: High
Integrity impact: High
Privileges required: Low
User interaction required: None

CVSS3

(Not available)

Attack complexity: -
Attack vector: -
Confidentiality impact: -
Integrity impact: -
Privileges required: -
User interaction required: -

CVSS2

(Not available)

Attack complexity: -
Attack vector: -
Confidentiality impact: -
Integrity impact: -
Privileges required: -
User interaction required: -

Learn more

Run an in-depth assessment with complete web risk management

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.

Explore CyStack VulnScan

Explore other related solutions

HB810(US2) V1.0/1.6/2.0/2.6

TP-Link Systems Inc.

HB810(EU1) V2.0

TP-Link Systems Inc.

HB710(US2) V1.6/1.0

TP-Link Systems Inc.

View all security vulnerabilities