CVE-2025-30241highCWE-78

CVE-2025-30241: falha de alta gravidade em TP-Link Systems Inc. EB210 Pro(EU1) 1.0

OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar VX800v+ Monitorar EX220

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.4%
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions.  An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
TP-Link Systems Inc. · EB210 Pro(EU1) 1.0TP-Link Systems Inc. · EB210 Pro(US1) 1.0TP-Link Systems Inc. · EB810v(EU1) V1.0TP-Link Systems Inc. · EX220(BR) V1.0/1.20/1.28/1.29/1.8TP-Link Systems Inc. · EX220(BR) V2.0TP-Link Systems Inc. · EX220(EU1) V1.0/1.20TP-Link Systems Inc. · EX220(RU) V1.0TP-Link Systems Inc. · EX220(US1) V1.0TP-Link Systems Inc. · EX222(EU1) V1.0TP-Link Systems Inc. · EX222(KR) V1.0TP-Link Systems Inc. · EX222(US1) V1.0TP-Link Systems Inc. · EX520v(EU1)1.0TP-Link Systems Inc. · EX820v(EU1) V1.0TP-Link Systems Inc. · EX920(US2) V1.6/V1.0TP-Link Systems Inc. · HB210(EU1) 1.0TP-Link Systems Inc. · HB210 Pro(EU1)1.0TP-Link Systems Inc. · HB210 Pro(US2)1.0/1.6TP-Link Systems Inc. · HB210(US2) 1.0TP-Link Systems Inc. · HB410( EU1) 1.0TP-Link Systems Inc. · HB610(CA) V2.0TP-Link Systems Inc. · HB610(EU1)TP-Link Systems Inc. · HB610(US2) V2.6/2.0TP-Link Systems Inc. · HB710(EU1) 1.0TP-Link Systems Inc. · HB710(US2) V1.6/1.0TP-Link Systems Inc. · HB810(EU1) V2.0TP-Link Systems Inc. · HB810(US2) V1.0/1.6/2.0/2.6TP-Link Systems Inc. · VX420-G2h(AU) V3.0TP-Link Systems Inc. · VX800v(DE) V1.0TP-Link Systems Inc. · XX230v(BR) V1.0TP-Link Systems Inc. · XX530v(BR)v2.0TP-Link Systems Inc. · XX530v(EU1)
CVEs relacionadas — TP-Link Systems Inc. EB210 Pro(EU1) 1.0

No mesmo produto, das mais perigosas para as menos.

CVE-2025-30240MEDIUMArbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet DevicesEPSS 0.2%CVE-2025-30239HIGHSensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet DevicesEPSS 0.2%CVE-2025-30238HIGHPrivilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet DevicesEPSS 0.2%