TP-Link has published a security advisory covering five newly disclosed vulnerabilities in its Aginet line of ISP-managed networking gear, spanning mesh systems, routers, PON devices, and xDSL modems. Chained together or exploited individually, the flaws could let an attacker on the local or adjacent network bypass authentication, escalate privileges, extract sensitive stored data, read arbitrary files, and run operating system commands on affected devices.

The advisory, last updated August 10, tracks the issues as CVE-2025-30237 through CVE-2025-30241. Because Aginet devices are typically supplied, branded, and firmware-managed by internet service providers rather than sold directly to consumers, the rollout of fixes will vary by carrier and region, and in many cases, users will have little visibility into when, or whether, their specific device has been patched.

An Authentication Bypass That Needs No Credentials

The most severe of the five, CVE-2025-30237, carries a CVSS v4 score of 8.7 and stems from broken access control in the web management interface. An attacker positioned on an adjacent network can send specially crafted requests directly to privileged functions, skipping the login process entirely. Successfully exploited, it hands an unauthenticated attacker full administrative control of the device.

Privilege Escalation and Hardcoded Keys

Two more high-severity bugs compound the risk. CVE-2025-30238 (CVSS 8.6) is an improper-authorization flaw in the user-management functions that lets a low-privileged, already-authenticated user perform administrator-level actions, including creating new privileged accounts or altering critical settings. CVE-2025-30239 (CVSS 8.5) involves hardcoded cryptographic keys baked into the firmware; anyone who can access the device’s storage can recover those keys and decrypt protected configuration data, potentially exposing credentials and ISP-specific service settings that could be leveraged for further attacks.

File Read and Command Injection Round Out the List

CVE-2025-30240 is a medium-severity arbitrary file-read bug reachable through the USB HTTPS access path, caused by improper handling of symbolic links on external USB storage; someone with physical access could plant a malicious symlink on a USB drive to reach sensitive files on the router’s filesystem. CVE-2025-30241 (CVSS 8.6) rounds out the set as an OS command-injection flaw in web-interface components that fail to sanitize user input before passing it to system-level functions, letting an authenticated local attacker run commands with elevated privileges.

Which Devices Are Affected

TP-Link’s advisory lists affected hardware across the HB, HX, HC, EB, EC, EX, XC, XX, and VX product series, including models such as the HB810, HB710, EX220, EX222, EX920, EC220-G5, XX530v, and VX1800v. The precise impact for any given unit depends on its regional variant, hardware revision, ISP customization, and installed firmware version.

What Users Can Do

• Check the router’s admin interface or your ISP’s management app for an available firmware update.
• If no update is listed, contact your internet provider directly to confirm whether your specific model is affected and when a fix is scheduled.
• Restrict exposure of the management interface, and disable remote management features that are not actively needed.
• Set a strong, unique administrator password rather than relying on any default credentials.
• Keep untrusted devices and users off the local network segment that can reach the router’s admin functions.

TP-Link says remediation for ISP-managed devices will be coordinated through the providers themselves, and that many updates may roll out automatically via carrier management platforms. Given the authentication-bypass bug requires no valid credentials at all, security teams managing fleets of ISP-supplied Aginet hardware should treat this advisory as a priority patching item rather than routine firmware housekeeping.