CVE-2025-30238: falha de alta gravidade em TP-Link Systems Inc. EB210 Pro(EU1) 1.0
Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.2%
In affected TP-Link Aginet devices, insufficient
authorization validation allows authenticated low-privileged users to execute higher-privileged
operations.
An attacker
may perform administrative actions such as creating privileged accounts or
modifying critical configuration settings.
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
TP-Link Systems Inc. · EB210 Pro(EU1) 1.0TP-Link Systems Inc. · EB210 Pro(US1) 1.0TP-Link Systems Inc. · EB810v(EU1) V1.0TP-Link Systems Inc. · EX141(BR) V1.0/1.9TP-Link Systems Inc. · EX141(EU1) V1.0TP-Link Systems Inc. · EX141(US1) V1.0TP-Link Systems Inc. · EX220(BR) V1.0/1.20/1.28/1.29/1.8TP-Link Systems Inc. · EX220(BR) V2.0TP-Link Systems Inc. · EX220(EU1) V1.0/1.20TP-Link Systems Inc. · EX220(RU) V1.0TP-Link Systems Inc. · EX220(US1) V1.0TP-Link Systems Inc. · EX222(EU1) V1.0TP-Link Systems Inc. · EX222(KR) V1.0TP-Link Systems Inc. · EX222(US1) V1.0TP-Link Systems Inc. · EX511(BR) V2.0/2.8/2.9TP-Link Systems Inc. · EX511(EU1) V2.0TP-Link Systems Inc. · EX511(US1) V2.0TP-Link Systems Inc. · EX520(US1) V1.0TP-Link Systems Inc. · EX520v(EU1)1.0TP-Link Systems Inc. · EX521(US1) V1.0TP-Link Systems Inc. · EX820v(EU1) V1.0TP-Link Systems Inc. · EX920(US2) V1.6/V1.0TP-Link Systems Inc. · HB210(EU1) 1.0TP-Link Systems Inc. · HB210 Pro(EU1)1.0TP-Link Systems Inc. · HB210 Pro(US2)1.0/1.6TP-Link Systems Inc. · HB210(US2) 1.0TP-Link Systems Inc. · HB410( EU1) 1.0TP-Link Systems Inc. · HB610(CA) V2.0TP-Link Systems Inc. · HB610(EU1)TP-Link Systems Inc. · HB610(US2) V2.6/2.0TP-Link Systems Inc. · HB710(EU1) 1.0TP-Link Systems Inc. · HB710(US2) V1.6/1.0TP-Link Systems Inc. · HB810(EU1) V2.0TP-Link Systems Inc. · HB810(US2) V1.0/1.6/2.0/2.6TP-Link Systems Inc. · HC220-G5(BR) V1.30TP-Link Systems Inc. · HC220-G5(EU1) V1.20/1.0TP-Link Systems Inc. · HC220-G5(US1) V1.0/1.6TP-Link Systems Inc. · HX141(EU1) V1.0TP-Link Systems Inc. · HX220(AU) V1.0TP-Link Systems Inc. · HX220(CA) V1.0TP-Link Systems Inc. · HX220(EU1) V1.0TP-Link Systems Inc. · HX220(US1) V1.0/1.6TP-Link Systems Inc. · HX510(AU) V1.0/2.0TP-Link Systems Inc. · HX510(CA) V1.0/2.0TP-Link Systems Inc. · HX510(EU1) V2.0TP-Link Systems Inc. · HX510(US1) V2.0TP-Link Systems Inc. · HX510(US2) 2.6TP-Link Systems Inc. · HX710(EU1) V1.0TP-Link Systems Inc. · HX710 Pro(EU1) V1.0TP-Link Systems Inc. · VX1800v(EU1) V1.0TP-Link Systems Inc. · VX420-G2h(AU) V3.0TP-Link Systems Inc. · VX800v(DE) V1.0TP-Link Systems Inc. · XC220-G3v(EU1) V2.30TP-Link Systems Inc. · XC220-G3v(US1) V2.30TP-Link Systems Inc. · XX230v(BR) V1.0TP-Link Systems Inc. · XX530v(BR)v1.0TP-Link Systems Inc. · XX530v(BR)v2.0TP-Link Systems Inc. · XX530v(EU1)TP-Link Systems Inc. · XX530v(US1)CVEs relacionadas — TP-Link Systems Inc. EB210 Pro(EU1) 1.0
No mesmo produto, das mais perigosas para as menos.
CVE-2025-30241HIGHOS Command Injection in Web Interface in Multiple TP-Link Aginet DevicesEPSS 0.4%CVE-2025-30240MEDIUMArbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet DevicesEPSS 0.2%CVE-2025-30239HIGHSensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet DevicesEPSS 0.2%
Referências
https://www.tp-link.com/us/support/faq/5239/